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Preface The Government of Canada relies on information 
and intelligence obtained through a variety of 
means and from a wide range of sources as part of 
its efforts to protect the country’s assets and inter- 
ests. Canada’s ability to meet its many internation- 
al obligations, for example, in peacekeeping efforts 
and the fight against terrorism, are assisted by 
intelligence collection, analysis and dissemination. 


During the early months following my appoint- 
ment, it became apparent to me that both the col- 
lectors and users of intelligence in Canada share 
the view that the end of the Cold War gave rise to 
new and complex challenges. Indeed, information 
and intelligence collected throughout the ’90s 
reveal a diversification of, and an increase in, 
threats to the security interests of many nations, 
including Canada. Political, social, and economic 
volatility and, in some instances, instability, togeth- 
er with the disappearance of a common foe, threat- 
en defences and security globally. 


The free movement of peoples and materiel has 
resulted in an increase in the threat of terrorism. It 
has also raised global concerns regarding the pro- 
liferation and ready availability of weapons of mass 
destruction, and contributed to the spread of 
organized criminal activity. Global economic and 
technological competition also play a role in this 
developing mosaic, and the number of potential 
and known targets--persons and organizations--has 
grown. 


In order to meet these challenges, the security and 
intelligence components of the Government of 
Canada have played a vital role in the collection, 
analysis and dissemination of information and 
intelligence on issues that affect national interests. 
As a member of Canada’s security and intelligence 
community, the Communications Security 
Establishment (CSE) contributes to these efforts 

_ through the delivery of its mandated programs, 
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commonly known as foreign signals intelligence 
(SIGINT) and information technology security (ITS). 


I believe, however, that the citizens of this country 
have a justifiable expectation that agencies that 
must conduct much of their business in secret do so 
in compliance with the laws of Canada. Providing 
this assurance in respect of CSE is my responsibility. 


My On June 19, 1996, the Minister of National Defence 
announced my appointment to the position of 


Appointment Communications Security Establishment 


Commissioner, pursuant to Part II of the Inquiries 
and Mandate Act, for a term of three years. I serve in this capaci- 

ty on a part-time basis, and my mandate, which is 

established by Order in Council, is as follows: 


¢ to review the activities of CSE for the purpose of 
determining whether they are in compliance with 
the law, 


e to advise the Minister of National Defence and 
the Attorney General of Canada of any activity of 
CSE that I believe may not be in compliance with 
the law, 


¢ not to review issues for which other avenues of 
redress are established by statute, 


¢ to submit to the Minister a report containing clas- 
sified information when I consider it advisable, 


¢ to submit to the Minister an annual report in both 
official languages on my activities and findings 
for tabling in Parliament. | 


On May 9, 1996 I retired as a judge of the Quebec 
Court of Appeal after more than twenty-seven years 
on the bench. Upon accepting my appointment as 
CSE Commissioner, I became immersed in aspects 
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of Canada’s security and intelligence community in 
general and CSE in particular. In this regard, the ori- 
gins of CSE are worth noting. 


ri à CSE’s role in the collection of SIGINT spans several 
0 LLL of CSE decades. In 1925, under the direction of the British 


Royal Navy (the Admiralty), the Royal Canadian 
Navy established Canada’s first high-frequency 
direction-finding (HF/DF) station at the Esquimalt 
naval base on Vancouver Island. In subsequent 
years, a series of stations were set up across 
Canada, and HF/DF intercepts served as a means of 
assisting the Admiralty to track ships in the Pacific 
Ocean; the Admiralty already had stations covering 
the Atlantic. 


Canada’s assistance to Britain grew during the late 
°20 and ’30s. At that time, SIGINT activities encom- 
passed not only locating and monitoring foreign 
transmissions via HF/DF, but expanded to include the 
monitoring of wireless intercepts by Canada’s 
Army and by the Department of Transport’s 
Wireless Service. With the onset of World War II, 
Britain sought Canada’s continued participation in 
providing direction-finding and raw intercept infor- 
mation which was used, for example, by the British 
Royal Navy and Britain’s Radio Security Service. 


As the war progressed and as the volume of raw 
data increased, Canada’s need for its own code and 
cipher-breaking capabilities was discussed and 
debated among various government officials, 
including those in Canada’s military services, the 
Department of External Affairs (DEA), the Royal 
Canadian Mounted Police (RCMP), and the National 
Research Council. During this period of debate, 
US and UK allies expressed their view that Canada 
ought to become an active participant and develop 
its own expertise in this area. 
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In 1941, at the urging of the Department of 
External Affairs, the government established a 
national signals intelligence bureau known as the 
Examination Unit (xu). The xu was located in the 
National Research Council and included participa- 
tion from the RCMP, DEA, and the three military ser- 
vices. Under xu coordination, raw intercepts and 
decrypted traffic were used by Canadian intelli- 
gence consumers, and were relayed to and from 
SIGINT allies in Britain and the United States. 
Intercepted traffic included messages from the 
Soviet Union, Germany, Italy, South America and 
Asia. By war’s end, the XU was renamed the Joint 
Discrimination Unit and was a fully-functioning 
signals intelligence service. 


Deliberations commenced in 1944 (principally 
among DEA, Army and Navy officials) to determine 
the need for, and the structure of, a possible post- 
war organization, as well as the role it would play 
in meeting the intelligence requirements of the gov- 
ernment of the day. It was at this juncture that the 
two programs that evolved into CSE’s current man- 
date began to take shape. 


First, it was determined that continued signals 
collection was necessary for the protection of 
Canada’s foreign and defence interests. The gov- 
ernment’s decision was influenced by requests for 
continuing intelligence assistance from the United 
States and Britain, and by Soviet defector Igor 
Gouzenko’s identification of Soviet intelligence 
activities in Canada and the United States. This 
gave birth to CSE’s SIGINT mandate. 


Second, it was clear that federal government 
departments and agencies now required advice and 
assistance to protect classified information from 
interception by unfriendly parties. This led to the 
creation of CSE’s defensive mandate, then known as 
Communications-Electronic Security (COMSEC), and 
now referred to as Information Technology Security 
(ITS). 
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In 1946, this new peacetime national cryptologic 
organization was established by Order in Council 
and renamed the Communications Branch, National 
Research Council (CBNRC), with responsibility for 
both SIGINT and COMSEC. In 1975, an Order in 
Council transferred CBNRC to the Department of 
National Defence and named the Minister responsi- 
ble for designated activities pursuant to section 4 of 
the National Defence Act. At the same time, the 
organization was renamed the Communications 
Security Establishment. 


Through CSE, Canada has maintained collaborative 
relationships with some of its close and long-stand- 
ing allies in exchanging foreign intelligence and 
sharing sensitive information technology security. 
The allies are the United States, the United 
Kingdom, Australia and New Zealand, and each has 
an organization that is analogous to CSE. 


Mandate of Today CSE is Canada’s national cryptologic agency. 
In its SIGINT capacity, CSE collects and analyzes 


CSE foreign radio, radar and other electronic emissions; 
it is assisted in this activity by the Canadian Forces 
Supplementary Radio System (CFSRS), a component 
of the Canadian Forces, which operates from a 
number of stations around the country. 


Through the provision of signals intelligence, CSE 
contributes to the government’s foreign intelligence 
program. Foreign intelligence refers to information 
or intelligence about the capabilities, intentions or 
activities of foreign states, corporations, or persons 
in relation to the defence of Canada or the conduct 
of its international affairs. It may include informa- 
tion of a political, economic, military, scientific or 
social nature that could have security implications. 


Through its ITS program, CSE provides technical 


advice, guidance and service on the means of 
assuring government telecommunications security 
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Calls for 
Review and 
Accountability 


and on aspects of electronic data processing securi- 
ty. CSE’s objective is to help the federal government 
achieve an appropriate level of security for its 
telecommunications and automated information 
systems. CSE meets this objective by providing 
departments with both the means and advice to 
ensure the protection of classified and designated 
information. In this capacity, the service provided 
by CSE is intended to prevent access to sensitive 
information carried on government telephone and 
computer systems by any unauthorized person or 
organization, and to protect the integrity and avail- 
ability of government information. 


The timing of my appointment in June 1996 was 
opportune for a number of reasons. First, the 
following month, the Privacy Commissioner issued 
a report to the Chief of CSE detailing the findings of 
a compliance audit he had recently completed. 

The audit report is a classified document; however, 
reference to the audit was made in the Privacy 
Commissioner’s public annual report. He observed 
that for a number of reasons, including the lack of a 
legislative framework, the CSE audit had proven to 
be a complex undertaking. In particular, he noted, 
‘in the midst of the audit, there were several 
public allegations that CSE was gathering data about 
Canadians and monitoring their legitimate political 
activities.” 


The Privacy Commissioner reviewed a representa- 
tive sampling of SIGINT data and reports and 
concluded that CsE collects only information that 
serves the government’s established foreign intelli- 
gence criteria. No evidence was found to support 
any allegations that CSE targets Canadians or moni- 
tors their communications. CSE uses strict proce- 
dures to minimize the possibility that information 
about Canadians is captured inadvertently. The 
Privacy Commissioner concluded, to the extent that 
it could be established through his audit, that CSE 
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operates in compliance with the Privacy Act and 
the principles of fair information practices. 
However, he recommended the enactment of 
enabling legislation, describing CSE’s mandate, 
powers, activities and responsibilities. 


In November 1996, the Auditor General of Canada 
tabled his report, The Canadian Intelligence 
Community-- Control and Accountability. The 
report, which offered a tour d’horizon of the com- 
munity, revealed that comprehensive policies and 
procedures exist at CSE to guide operational activi- 
ties and that operations related to safeguarding the 
privacy of Canadians are reviewed annually. It 
identified a need for continuing progress, however, 
in the areas of control and accountability. In this 
regard, the report made reference to the establish- 
ment and mandate of my office, and its existence as 
an external mechanism to review CSE’s foreign 
signals collection activities. 


The Auditor General’s report expressed the view 
that the activities of my office should increase the 
scope for informed parliamentary scrutiny and 
debate, including the question of whether it would 
be in the public interest for Parliament to consider 
establishing a statutory basis for CSE. The report 
concluded with a call to the government to consider 
the advantages of an appropriate legislative 
framework. 


iret. My first tasks following my appointment revolved 
i eile around establishing and staffing my office. With 
the support of officials at the Privy Council Office 
and the Department of National Defence, my office 
Activities was soon centrally located in downtown Ottawa. 
However, modifications were required to upgrade 
the premises to meet the standard required for 
handling and storing classified material. By 
September, my office was established and fully 
operational. 
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At CSE headquarters two offices were also made 
available. This arrangement facilitated my and my 
staff’s ability to obtain and examine classified and 
sensitive information without having to introduce 
complex and cumbersome procedures to transfer 
documents to my office downtown. 


As I launched my review function, I was cognizant 
that I was not charting new territory; review mecha- 
nisms have been enshrined in legislation and active 
within sectors of the intelligence community in 
Canada and abroad for years. I was able to benefit 
from the experiences of these review bodies. 


For example, both the Inspector General of CsIs and 
the Security Intelligence Review Committee (SIRC) 
came into being following the creation of CSIs and 
pursuant to the Canadian Security Intelligence 
Service Act in 1984. I met with the current 
Inspector General and the Chair of SIRC, who were 
generous with their time. I was also pleased to 
have the opportunity to meet and discuss review 
mandates with the Australian Inspector General of 
Intelligence and Security, during his visit to Canada 
in September. 


An extensive series of meetings occupied my time 
and that of my staff during the autumn months. 
There were detailed discussions at CSE regarding its 
mandate and operations and at Leitrim, Ontario, on 
the Canadian Forces Supplementary Radio System. 
There were also discussions with the Director of 
csIs and his officials, and with the Senior Adviser 
and Coordinator of Security and Intelligence, Privy 
Council Office, and his officials, whose information 
allowed me to gain an appreciation of the broader 
aspects of the community. 


I had an opportunity to meet with the Auditor 
General of Canada and the Privacy Commissioner 
to discuss their respective reports. In addition, 
the Deputy Minister of Justice, and his officials 
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provided valuable information regarding the role 
Justice plays in the security and intelligence com- 
munity in general, and at CSE in particular. 


There are obviously limitations to what I am able 
to report about CSE and its operations. It functions 
in a highly complex environment and must keep 
abreast of the rapid pace of changing technology. 
However, my staff and I had unfettered access, and 
we were given all the information and documenta- 
tion we requested. I benefitted from a broad 
overview of all CSE activities, some of which I later 
examined in greater detail. 


During this initial period of review, I focussed my 
attention on the control and accountability mea- 
sures currently in place at CSE. In doing so I drew 
considerable value from the discussion of these 
measures in the report of the Auditor General. 
Specifically, I concur with the Auditor General’s 
assessment of the important legal function exer- 
cised by the Department of Justice. Legal counsel 
assigned to CSE from Justice are members of CSE’s 
senior management team and an integral part of the 
operational decision-making process. They are 
fully cleared for, and have access to, all informa- 
tion. On a continuing basis, they provide advice on 
the legality of activities under consideration and of 
existing operations, to determine whether they are 
in accordance with the law. 


As is the case with most federal departments and 
agencies, CSE is also subject to external review. Its 
activities must withstand the independent scrutiny 
of the courts, the Canadian Human Rights 
Commission, the Privacy Commissioner, the 
Information Commissioner, the Commissioner of 
Official Languages and, of course, the Auditor 
General of Canada. As noted in the Auditor 
General’s report, however, these review bodies can 
bring to bear only their specific mandates in 
carrying out their work. 
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Findings 


10 


Control and accountability at CSE are equally 
evident at the ministerial level, since the Minister of 
National Defence is answerable in Parliament for 
all CSE activities. The Minister must approve capi- 
tal spending and major spending recommendations 
made to Treasury Board. The Minister also 
approves key policy initiatives and is responsible 
for CSE issues in Cabinet. 


Two deputy ministers, the Security and Intelligence 
Coordinator in the Privy Council Office and the 
Deputy Minister of National Defence, are responsi- 
ble for ensuring that the Minister is fully informed 
of CSE’s activities. The Security and Intelligence 
Coordinator is accountable for CSE’s policy and 
operations, and the Deputy Minister of National 
Defence is accountable for administrative matters. 
CSE responds to foreign intelligence needs approved 
by Cabinet and to specific departmental requests or 
event-driven intelligence needs of the government. 


Based on the results of my own review and analy- 
sis, I am of the opinion that CSE has acted lawfully 
in the performance of its mandated activities during 
the period under review. I am also satisfied that CSE 
has not targeted Canadian citizens or permanent 
residents. In this regard, my opinion has been rein- 
forced by the reports of the Privacy Commissioner 
and the Auditor General of Canada, referred to 
earlier. | 


Paragraph (c) of the Order in Council appointing 
me CSE Commissioner authorizes me to submit a 
report containing classified information to the 
Minister of National Defence any time that I 
consider it advisable. In March 1997, I submitted a 
report to the Minister, bringing to his attention 
certain procedures that, in my opinion, required 
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some review and refinement. The issues I raised 
were resolved to the satisfaction of all parties. 
Unlawful activity on the part of CSE was not the 
subject of this report. 


A topic of continuing discussion is the issue of 
enabling legislation for CSE. An early reference to 
this issue appeared in the form of a recommenda- 
tion in the Report of the Special Parliamentary 
Committee on the Review of the CSIS Act, which 
was tabled in September 1990. Subsequently, the 
matter was raised on a number of occasions, most 
recently by the Privacy Commissioner and the 
Auditor General. 


There is no doubt that CSE occupies a unique 
position within the structure of the government of 
Canada, and not only because of its mandate. It 
does not have a legislative framework, nor does its 
name appear in the schedules of the Financial 
Administration Act. Yet, in my opinion, a number 
of policy issues should be examined or revisited 
before any decision is taken to begin legislative 
drafting. These include the scope and structure of a 
legislative framework, as well as limitations and 
related policy issues; control and accountability 
issues; and the scope and structure of enshrined 
review mechanisms. 


Despite recent calls for legislation for CsE, I do not 
intend to express any further opinions on this topic 
until I have had time to study the matter further. 
However, I cannot help but note the remarkable 
window of opportunity these calls present given the 
new and complex challenges in the security and 
intelligence landscape, and the rapid pace of tech- 
nological change, both of which go to the heart of 
CSE’s mandate. 
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Under the terms and conditions of the Order in 
Council appointing me Commissioner, I am 
precluded from reviewing issues for which other 
avenues of redress are established by statute, and 

I am able to review only those issues that relate 
directly to the mandate of CSE. This does not seem 
unreasonable to me given the focus of my mandate, 
and the fact that my office was never intended to be 
a court of last resort. Also, as I indicated when I 
was named Commissioner, I do not intend to review 
incidents that predate my appointment. 


Despite the clarity of my mandate, one limitation 
may prove problematic in the longer term. While I 
am authorized to review any allegation concerning 
certain activities of CSE, I cannot inform individual 
complainants of the fact of my review or my find- 
ings. This may lead to dashed expectations, given 
the purpose of my office. However, some comfort 
should be drawn from the general assurance I can 
provide in this report of the lawfulness of CSE’s 
activities. 


I requested and was allocated an annual budget of 
$500,000, including salaries for three full-time posi- 
tions. In addition, rather than establishing a larger 
staff complement, I have opted to secure expert 
services as I require them on a contractual basis. 


I am able to report that during the first ten-month 
period of operation, my office was established and I 
discharged my mandated activities within budget. 


Obviously, it was not possible to review all aspects 
of CSE’s complex operations within the first ten 
months of my mandate. Therefore, during the next 
year, my main priority is to continue reviewing the 
activities of CSE, examining some of them in greater 
depth, and to issue periodic reports to the Minister 
of National Defence as appropriate. I also anticipate 
further discussions arising from the limitation I 
referred to previously. 
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In closing, I believe it is important to acknowledge 
that the government will continue to require CSE to 
deliver its foreign intelligence and information 
security programs even as the provisions of a 
constituent act are under debate. In the meantime, 
the issue of legislation remains of abiding interest 
to me, and I anticipate becoming involved in the 
discussions that will no doubt ensue. 
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CANADA P.C. 1996-899 
PRIVY COUNCIL @ CONSEIL PRIVÉ ite, TO LS 06 


His Excellency the Governor General in 
Council, on the recommendation of the Minister of 
National Defence, pursuant to Part II of the Inquiries 
Act, hereby authorizes the Minister of National Defence 
("Minister?}: 


(a) to appoint the Honourable Claude Bisson of 
Montreal, Quebec, for a period of three years, as 
a commissioner ("Commissioner") to review the 
activities of the Communications Security 
Establishment ("CSE") for the purpose of 
determining whether those activities are in 
compliance with the law; 


(b) to direct the Commissioner to submit to the 
Minister, once each year and in both official 
languages, a report on the Commissioner's 
activities and findings that are not of a 
classified nature, which report the Minister will 
table in Parliament; 


(c) to authorize the Commissioner, at any time the 
Commissioner considers it advisable, to submit a 
report containing classified information to the 
Minister; 


(d) to direct the Commissioner to advise the 
Minister and the Attorney General of Canada of any 
activity of CSE that the Commissioner believes may 
not be in compliance with the law; 


(e) to direct the Commissioner not to review 
issues for which other avenues of redress are 
established by statute; 


he 
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(f) to require that the Commissioner and all 
persons engaged on his behalf take an oath of 
secrecy and comply with all applicable government 
security requirements; 


(g) to direct the Commissioner, before submission 
of any report to the Minister, to consult with the 
Deputy Clerk, Security and Intelligence, and 
Counsel at the Privy Council Office for the 
purpose of ensuring compliance with all security 
requirements and preservation of the secrecy of 
sources of security and intelligence information 
and of the security of information provided to 
Canada in confidence by other nations; 


(h) to authorize the Commissioner to engage the 
services of such staff and technical advisors as 
he considers necessary to assist him in his 
review, at such rates of remuneration and 
reimbursement as may be approved by the Treasury 
Board; 


(i) to fix the remuneration of the Commissioner at 
the per diem rate set out in the schedule hereto, 
which rate is within the range of $400 to $500; 
and 


(j) to authorize that the Commissioner be 
reimbursed for his actual transportation expenses 
and a non-accountable living allowance of up to 
$175 per diem while in travel status away from his 
normal place of residence in connection with the 
conduct of this review. 


CERTIFIED TO BE A TRUE COPY - COPIE CERTIFIEE CONFORME 
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101 Colonel By Drive, North Tower 
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Dear Mr. Eggleton: 

Pursuant to paragraph (b) of Order in Council P.C. 1996-899 
appointing me Communications Security Establishment Commissioner, I am 
pleased to submit to you my second annual report on my activities and findings 


from April 1, 1997 to March 31, 1998, for your submission to Parliament. 


Yours sincerely, 


The Honourable Claude Bisson 
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The Year 
in Brief 


Findings 


Foreign 
Intelligence 
Priorities 


This is my second Annual Report, and it covers the 
period ending March 31, 1998. It was a busy year 
that included extensive meetings and briefings with 
officials at the Communications Security 
Establishment (CSE) and other government 
departments, submitting periodic classified reports 
to the Minister of National Defence on my study 
findings, and forging new relationships and 
cementing old ones both in Canada and 
internationally. 


I was ably represented at the first International 
Meeting of Inspectors General of Intelligence and 
Security in Canberra, Australia, in November and 
at follow-up discussions in Washington, D.C., in 
April 1998. I also had the pleasure of meeting and 
briefing members of the Parliamentary Intelligence 
and Security Committee of the United Kingdom in 
March 1998. 


The capabilities of my Office were expanded 
during this period. I have a small professional staff 
and contractors with expertise in a variety of areas 
including high technology. 


I discuss these topics in greater detail further on in 
this report, along with other matters that have 
captured my attention since my last report. 


Each year, the Government establishes its 
intelligence requirements, including its foreign 
intelligence priorities. These priorities are then 
communicated in writing to the Chief of CSE, by the 
Security and Intelligence Coordinator, Privy 
Council Office. As part of its response, CSE 
develops a business plan that guides the signals 
intelligence (SIGINT) program. 


I examined the foreign intelligence priorities and 
the SIGINT business plan and I am able to confirm 
that for the fiscal year 1997/98, CSE’s activities 
were consistent with these priorities. 
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SIGINT Policy 
at CSE 
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In the course of my review activities, I had occasion 
to look at CSE’s framework for SIGINT policies with 
lawfulness implications. I wanted to examine 
specific CSE policies to determine whether they 
provided adequate guidance to employees in the 
performance of their duties. I was particularly 
interested in policies related to privacy issues. 


I found CSE’s SIGINT policies to be sound. The 
policies in place, as well as the system under which 
they are developed, appear to be well conceived. 
Moreover, the procedural documentation drafted in 
support of these policies is comprehensive and 
clearly stated. 


During my examination of these policies, I did 
observe that while CsE has an appreciable amount 
of policy, it is not always at the right organizational 
level. However, I did not encounter any major 
SIGINT policy gaps, and I can provide my assurance 
that none of the gaps related to the lawfulness of 
CSE’s activities or to the privacy of Canadians. 


I noted that a cornerstone of CSE’s SIGINT policies 
deals with safeguarding the privacy of Canadians. 

It applies to information in the possession of CSE, 
for the purpose of providing the government with 
foreign signals intelligence, in support of its foreign 
and defence policies. 


I was able to observe that the policies require CSE 
employees to conduct their operational activities in 
strict recognition of, and adherence to, federal 
legislation governing the protection of the rights, 
privacy and freedoms of Canadians. The policies 
affirm CSE’s commitment to respect the 
corresponding procedures of its close and long- 
standing allies, Australia, New Zealand, the United 
Kingdom and the United States (also known as the 
Second Parties). However, these procedures must 
conform first to the laws of Canada. 


CSE undertakes explicitly to treat the 
communications of Second Party nationals in a 
manner consistent with the procedures issued by the 
agency of that country, provided such procedures do 
not contravene the laws of Canada. This is a 
reciprocal undertaking to ensure that the Second 
Parties do not target each others’ communications or 
circumvent their own legislation by targeting 
communications at each others’ behest. In other 
words, they do not do indirectly what would be 
unlawful for them to do directly. 


During discussions, CSE officials referred to their 
Key SIGINT policies as “living, breathing 
documents.” In this regard, I noted that these 
policies are the subject of ongoing internal review. I 
also found that the policy design includes indicators 
to measure the effectiveness of the policy, one of 
which 1s the result of any audit carried out by the 
Privacy Commissioner. (I referred to his most 
recent findings on this topic in my last report.) 
Historically, these indicators have been used to 
guide subsequent iterations of the policy. 


Among the mechanisms used to ensure that 
employees acquire the knowledge they need to 
discharge their duties lawfully are training on 
policies and on-the-job mentoring. I learned that 
over the past year, employees were also brought 
together to participate in an exercise to identify, 
among other things, the organization’s core values. 
CSE officials stated that, without exception, all focus 
groups of employees identified the value of 
lawfulness as a core CSE value. 


Internal I was interested to learn about internal 
Investigations and investigations and complaints at CSE. I examined 
Complaints reports and documents pertaining to all incidents 
involving employees since my appointment in June 
1996. I wanted to know whether any of the 
incidents involved unlawful activity in the delivery 
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of CSE’s mandate. To protect the privacy rights of 

the individuals involved, procedures were adopted 
to ensure that their names and any other identifiers 
were shielded from view. 


The incidents I reviewed involved a variety of 
matters such as miscellaneous internal security 
violations and infractions; however, there were no 
discernible trends. None of the incidents involved 
unlawful activity in relation to CSE’s mandate, or 
infringements on the privacy of Canadians. 


. also wanted to know what procedures were in 
place for employees who resign or are released. I 
learned that CSE had identified, and is in the process 
of implementing, a comprehensive program to 
address these and other matters. This is a positive 
first step, and I intend to look at it again at a future 
date. 


Assertion on During the year under review, my office refined its 
Lawfulness procedures for examining the electronic gateway to 

the information collected and held by CSE. Based 
on the results of this review and analysis, I am of 
the opinion that CSE has acted lawfully in the 
performance of its mandated activities since my last 
report. I am also satisfied that CSE has not targeted 
Canadian citizens or permanent residents. 


In giving assurance that CSE does not target the 
communications of Canadians, I would like to add, 
for greater certainty, that this applies to all 
Canadians, including the people of Québec. CSE 
does not target Québec communications, or the 
Québec sovereignty movement, and it does not 
have a “French Section”. 


The Order in Council appointing me CSE 
Commissioner appears in an appendix to this 
report. Paragraph (c) authorizes me to submit a 
report containing classified information to the 


4 = ANNUAL REPORT 1997-1998 


Minister of National Defence any time I consider it 
advisable. Since my last report, I have submitted 
three classified reports to the Minister. None of 
these reported on unlawful activity on the part of 
CSE. 


The Review The first International Meeting of Inspectors 

General of Intelligence and Security was held in 
Networ K Canberra, Australia, in November 1997. Office 

holders responsible for reviewing the activities of 
all or parts of the security and intelligence 
community of their respective countries were 
present from Australia, New Zealand, the United 
Kingdom, the United States, South Africa and 
Canada. The South African delegates were 
afforded a warm welcome given that their country’s 
national institutions, particularly their security and 
intelligence agencies, are in transition following the 
end of apartheid. 


The meeting was held at the initiative of the former 
Australian Inspector General, in honour of the tenth 
anniversary of his Office. It provided a welcome 
opportunity for participants to exchange 
information and ideas, to discuss trends and to 
compare models for effective review and oversight. 


A broad array of options and alternatives was 
apparent in the mandates and organizational 
arrangements of the Inspectors General represented 
at the meeting. Some have legislated mandates, 
such as those in Australia, New Zealand and 
Canada’s Inspector General of the Canadian 
Security Intelligence Service (CsIS). Others are 
independent of, or embedded in, the agencies they 
oversee. The mandates of Inspectors General in the 
United States run the gamut of these alternatives, 
and there do not appear to be hard and fast rules 
regarding the scope of their responsibilities or their 
degree of independence from the agency under their 
review. 
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It was also interesting to note the array of options 
for parliamentary review and oversight 
mechanisms. Representing the parliamentary 
review model were members of the United 
Kingdom’s Parliamentary Intelligence and Security 
Committee, described as a committee of 
parliamentarians rather than a formal statutory 
committee of Parliament; Canada’s Security 
Intelligence Review Committee, composed of three 
to five Privy Councillors appointed by the 
government to review the activities of CSIS; and 
members of the Joint Standing Committee on 
Intelligence, a committee of parliamentarians in 
South Africa where the government is in the 
process of identifying a model for intelligence 
oversight. In addition, participants met with 
Australia’s Parliamentary Joint Committee on the 
Australian Security Intelligence Organization (ASIO) 
as part of the program. 


While there were obvious commonalities, a wide 
range of mandated review or oversight activities 
was evident among the participants. These 
included such responsibilities as 


¢ monitoring the lawfulness of the agency’s 
activities, 
e safeguarding the rights of citizens, 


e investigating incidents and operational activities 
that generated public controversy, 


e investigating complaints received from a variety 
of sources, 


e investigating security practices, access to 
information and privacy concerns, 


° monitoring activities and reporting findings to 
the legislative or the executive arm of 
government, and 


¢ providing assurance to the responsible Minister 
or member of Cabinet. 
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Some participants had responsibilities as diverse as 
investigating fraud, waste and abuse of resources 
and uncovering criminal activity. 


Each country’s review and oversight mechanisms 
tend to be structured according to the division of 
roles, mandates and powers between their 
parliamentary and non-parliamentary bodies, or 
their executive and legislative branches of 
government. The division of these elements is 
influenced by a variety of factors, such as 


¢ the presence or absence of enabling legislation 
for the agencies under review, 


e the nation’s preference for parliamentary versus 
non-parliamentary (or executive versus 
legislative) responsibility for review and 
oversight of security and intelligence agencies, 


e the existence of other statutory bodies (in 
Canada, for example, the Information and 
Privacy Commissioners and the Auditor 
General). 


It was clear that in each country represented, a 
determination had been made regarding the best 
means of achieving effective review or oversight, 
drawing from the pool of expertise represented by 
elected officials, parliamentary appointees and 
bureaucrats. 


There was consensus that review and oversight had 
evolved over the years and would continue to 
evolve, particularly in those countries where 
enabling legislation has been enacted most 
recently. Of particular note was the general 
agreement that the very presence of review and 
oversight mechanisms tends to alter the dynamics 
of security and intelligence agencies, causing them 
to assess and, if necessary, modify the way they 
conduct business. Over time, these agencies have 
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begun to appreciate that there are benefits to review 
and oversight, including the capability to identify 
and resolve problems within their own walls. 


Despite the differing review and oversight mandates 
of those present, a number of common issues and 
themes emerged. For example, increased demands 
for greater transparency and accountability in 
government were a common backdrop to the 
activities of all participants. 


Independence and objectivity were identified as 
essential to successful review. Overall, relationships 
between the review or oversight bodies and their 
respective agencies were characterized as formal, 
proper and generally cordial. All participants 
agreed that maintaining independence and building 
confidence and credibility, not only with the agency 
being reviewed but with the public, is a constant and 
delicate balancing act. They also acknowledged the 
inherent difficulty of maintaining public confidence 
on those occasions when they find no fault in the 
activities of the bodies they oversee or review. 
There was consensus, however, that maintaining the 
right balance was facilitated by time and experience. 


The Canberra meeting opened the door for further 
discussions during the year. In March, I had the 
opportunity to pursue some of these themes in 
further detail when the members of the United 
Kingdom’s Parliamentary Intelligence and Security 
Committee visited Ottawa as part of their North 
American agenda of consultations. Subsequently, 
in April, my staff had fruitful discussions with some 
of my American counterparts in Washington, D.C. 


To sum up, it was clear from these discussions that 
review and oversight mechanisms are relatively 
new features in the security and intelligence 
community worldwide, and that they continue to 
evolve. They play an important role in responding 
to calls for greater transparency and accountability 
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in government. By their very presence, these 
mechanisms encourage security and intelligence 
agencies to assess and, if necessary, modify the 
way they conduct business. 


I am of the opinion that our small community of 
independent monitors can continue to reap 
significant benefits by sharing their collective 
wisdom on these topics. 


Complaints As I explained in my last report, I am precluded 
from reviewing CSE-related matters for which other 


avenues of redress are established by statute. 
Moreover, my review is confined to those issues 
that relate to CSE’s mandate. Furthermore, and as I 
stated at the time of my appointment, I will not 
review incidents that occurred before my 
appointment. 


I also referred, in my last report, to a limitation in 
my mandate regarding complaints. While I can 
review allegations about certain of CSE’s activities, I 
am unable to follow up with individual 
complainants to tell them about my examination of 
their allegations and my findings. 


This situation remains unchanged today. As a 
result, I must once again ask those concerned to 
derive some comfort from the general assurances I 
have provided elsewhere in this report on the 
lawfulness of CSE’s activities. 


It is clear that this is not a satisfactory situation. 
Individuals who are concerned about the activities 
of an agency of government ought to have recourse 
to an independent office where their complaints can 
be heard and examined. 


I am optimistic, however, that this matter will be 


resolved in the near future, and hopefully before 
my next report. 
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Reviewing CSE 
Activities: 

A Permanent 
Model 


10 


As I approach my third year as Commissioner I am 
frequently asked what will happen to my Office at 
the end of my mandate in June 1999. While this 
decision ultimately rests with the Government, I 
anticipate that a number of opinions will be voiced 
by a variety of interested parties, along with ideas 
on the best model for a permanent review 
mechanism. 


Over the past two years, I have had many 
opportunities to reflect on this subject, and to 
consider a possible structure. As my starting point, 
I looked at my own Office and the attributes and 
requirements that I identified to discharge my 
current mandate. Among them are 


e independence, 


¢ clearly defined mandate and reporting, 


e knowledge and understanding of CSE’s 
operational methods and activities, 


e understanding of the laws of Canada and their 
application, 

e effective means of assessing the lawfulness of 
CSE’S activities, 

¢ a professional relationship with CSE’s officials, 


e effective relationships with other interested 
parties in government, and 


¢ adequate and appropriate resources. 


I have also identified four elements that could have 
an impact on the model selected, even if they go 
beyond the immediate requirements and structure 
of a review mechanism. 
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Legislation While it is clear that enabling legislation is not 
required to establish a permanent review 
mechanism for CSE, the review mechanism itself 
ought to be incorporated eventually in a constituent 
act. This raises a number of policy and related 
questions for the drafters of the legislation, as is 
evident from the array of options represented at the 
meeting in Australia. 


Reporting Under the provisions of my Order in Council, I 
submit my reports to the Minister of National 
Defence. Based on my experience to date, I am of 
the opinion that this arrangement works well. 
However, I have also observed that some of my 
counterparts, both in Canada and abroad, report 
directly to Parliament. This alternative should also 
be examined for the permanent review mechanism. 


Mandate My mandate is set out in the Order in Council, 
reproduced in an appendix to this report. It was 
evident from my discussions with colleagues that I 
have a very focused mandate. While I believe it is 
adequate under the present circumstances, 
consideration should be given to exploring 
alternatives for the mandate of a permanent review 
mechanism. It is important to ensure any 
permanent mechanism gives the Government, and 
the public, an appropriate degree of comfort with 
respect to CSE’s activities. 


Legislation in Other I found great value in the exchange of ideas and 
i experiences with my colleagues in other countries. 
eunmgs A review of their legislation and further 

consultations might be of benefit. While I believe 
that this might reveal the need for a uniquely 
Canadian solution, there is often much to be 
learned from other countries, particularly the 
parliamentary models of the United Kingdom, 
Australia and New Zealand. 
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Legi S| ation In my last report, I indicated that there was support 

in a number of circles for enabling legislation for 
for CSE CSE, and this continues to be the case. I also 

identified several policy issues that I thought should 
be studied or revisited prior to drafting, including 
the scope and structure of a legislative framework, 
control and accountability issues, and the scope and 
structure of enshrined review mechanisms. 


During the past year, I have observed a great deal of 
hard work to grapple with fundamental issues 
affecting CSE and its place in government. 
Moreover, I have noted increased efforts toward 
greater Openness on matters related to CSE. I 
applaud these initiatives because they help build 
public confidence in an agency that makes an 
important, if secret, contribution to the 
government’s priorities and to Canada’s security 
and defence interests. 


Drafting legislation for CSE will be a challenge that 
should not be underestimated, in view of the rapid 
pace of change in the worlds of security and 
intelligence and technology. I anticipate animated 
debates on the topic. 


Budget and My annual budget allocation remained unchanged 
at $500,000 for the 1997/98 fiscal year. I am able 
Staff to report that during my office’s second year of 
operation, I discharged my mandated activities 
within budget. 


I have a full-time working staff of two as well as a 
complement of people on contract who bring many 
years of experience in a variety of fields related to 
the work of my office. Some of my staff are well 
versed in the workings of Canada’s security and 
intelligence community; others have special 
expertise in research, policy development, writing, 
editing and communications. More recently, I have 
engaged an adviser on high technology. 
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The year 1997/98 was my Office’s first full year of 
operations, and it was filled with challenges and 
opportunities. I am satisfied with the structure and 
operation of my Office, and I believe that I have 
both the resources I need and the access to CSE that 
I require to discharge my responsibilities in the 
year ahead. 
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ARE P.C. 1996-899 


PRIVY COUNCIL @ CONSEIL PRIVÉ Juneis19 51996 


His Excellency the Governor General in 
Council, on the recommendation of the Minister of 
National Defence, pursuant to Part II of the Inquiries 
Act, hereby authorizes the Minister of National Defence 
("Minister"): 


(a) to appoint the Honourable Claude Bisson of 
Montreal, Quebec, for a period of three vears, as 
a commissioner ("Commissioner") to review the 
activities of the Communications Security 
Establishment ("CSE") for the purpose of 
determining whether those activities are in 
compliance with the law; 


(b) to direct the Commissioner to submit to the 
Minister, once each year and in both official 
languages, a report on the Commissioner's 
activities and findings that are not of a 
classified nature, which report the Minister will 
table in Parliament; 


(c) to authorize the Commissioner, at any time the 
Commissioner considers it advisable, to submit a 
report containing classified information to the 
Minister; 


(d) to direct the Commissioner to advise the 
Minister and the Attorney General of Canada of any 
activity of CSE that the Commissioner believes may 
not be in compliance with the law; 


(e) to direct the Commissioner not to review 
issues for which other avenues of redress are 
established by statute; 


ane 
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(f) to require that the Commissioner and all 
persons engaged on his behalf take an oath of 
secrecy and comply with all applicable government 
security requirements; 


(g) to direct the Commissioner, before submission 
of any report to the Minister, to consult with the 
Deputy Clerk, Security and Intelligence, and 
Counsel at the Privy Council Office for the 
purpose of ensuring compliance with all security 
requirements and preservation of the secrecy of 
sources of security and intelligence information 
and of the security of information provided to 
Canada in confidence by other nations; 


(h) to authorize the Commissioner to engage the 
services of such staff and technical advisors as 
he considers necessary to assist him in his 
review, at such rates of remuneration and 
reimbursement as may be approved by the Treasury 
Board; 


(i) to fix the remuneration of the Commissioner at 
the per diem rate set out in the schedule hereto, 
which rate is within the range of $400 to $500; 
and 


(j) to authorize that the Commissioner be 
reimbursed for his actual transportation expenses 
and a non-accountable living allowance of up to 
$175 per diem while in travel status away from his 
normal place of residence in connection with the 
conduct of this review. 


CERTIFIED TO BE A TRUE COPY - COPIE CERTIFIEE CONFORME 


CLERK OF THE PRIVY COUNCIL - LE GREFFIER DU CONSEIL PRIVE 
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Dear Mr. Eggleton: 

Pursuant to paragraph (b) of Order in Council P.C. 1996-899 
appointing me Communications Security Establishment Commissioner, I am 
pleased to submit to you my third annual report on my activities and findings 
during the last year of my mandate, for your submission to Parliament. 

Yours sincerely, 
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Three Years of 
Reviewing CSE 


On June 19, 1996, the Minister of National Defence 
appointed me to the position of Communications 
Security Establishment (CSE) Commissioner for a 
period of three years, with the mandate to review the 
activities of CSE to determine whether they are in 
compliance with the law. 


As noted in my earlier reports, CSE provides the 
Government of Canada with foreign intelligence, 
which it obtains by gathering and analyzing foreign 
radio, radar and other electronic emissions. This is 
called signals intelligence or SIGINT. CSE also 
provides technical advice, guidance and service on 
the means of protecting the security of government 
telecommunications and aspects of electronic data 
processing. This is known as Information 
Technology Security or ITS. 


Clearly, the work CSE performs is highly sensitive. 
The foreign intelligence it collects provides the 
government with valuable information about foreign 
and defence policy issues in response to intelligence 
priorities established by Cabinet. 


The three-year term of my first mandate has now 
ended. In this, my third Annual Report, covering the 
period to March 31, 1999, I will discuss the 
activities of the past year but also reflect on the 
evolution of the review function for CSE since my 
appointment in 1996. 


The knowledge gained and lessons learned during 
my first mandate will be instrumental in ensuring 
further progress during my second mandate, which 
the Minister of National Defence announced on June 
15, 1999. The new mandate, which will be in force 
until June 19, 2002, maintains the elements of the 
first one and enhances one important element — the 
complaints function of my office. [ am pleased with 
this change, which responds to concerns I raised in 
my past two annual reports. This development and 
its implications are described below. 
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As noted in last year’s report, I am satisfied with 
the resources at my disposal and with my access to 
CSE. In carrying out my review activities, I have the 
support of two full-time staff people and several 
experts retained on contract. My views about CSE 
are based not only on my own observations but also 
on the hard work of people who know the 
intelligence community and are familiar with the 
complex technology that is part of its day-to-day 
environment. 


Looking Back on My original detailed mandate, established by Order 
the First Mandate in Council in 1996 pursuant to the /nquiries Act, 
was: 


° to review the activities of CSE to determine 
whether they are in compliance with the law, 


° to advise the Minister of National Defence and 
the Attorney General of Canada of any activity of 
CSE that I believe may not be in compliance with 
the law, 


¢ not to review issues for which other avenues of 
redress are established by statute, 


¢ to submit to the Minister of National Defence a 
report containing classified information when I 
consider it advisable, and 


¢ to submit to the Minister an annual report in both 
official languages on my activities and findings 
for tabling in Parliament. 


A copy of the original Order in Council is 
appended to this report as Annex A. 


As might be expected, I know much more about CSE 
now than I did when I took on this challenge three 
years ago. As my staff and I have learned more, we 
have asked CSE officials for more detailed 
information. Our questions continue to probe 
matters related to the lawfulness of CSE’s activities 
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in a very penetrating Way. In return, we expect and 
receive increasingly detailed explanations, which 
we then assess in each instance to determine 
whether there is logical continuity. 


During my first mandate, I reviewed the lawfulness 
of CSE’s activities from several perspectives. 
Initially I decided to focus on the control and 
accountability measures in place in CSE. 

For example, I was pleased to note the presence of 
legal counsel on CSE’s senior management team. 
These lawyers, assigned to CSE by the Department 
of Justice, advise on the lawfulness of CSE’s 
existing and planned activities and play an 
important part in the organization’s decision 
making. I observed as well that CSE is subject to 
the independent scrutiny of the courts, the 
Canadian Human Rights Commission, the Privacy 
Commissioner, the Information Commissioner, the 
Commissioner of Official Languages, and the 
Auditor General. 


I also examined CSE’s reporting relationships. 

In Parliament, the Minister of National Defence is 
answerable for all CSE’s activities. The Minister is 
supported by two deputy ministers — the Deputy 
Minister of National Defence for administrative 
matters, and the Deputy Secretary to the Cabinet 
(Security and Intelligence) in the Privy Council 
Office for policy and operations. 


Next, I examined CSE’s internal policies and 
procedures, the processes for reviewing and 
improving them, and programs for training 
employees about them. In an organization such as 
CSE, which operates without legislation in a very 
sensitive area, policies and procedures that 
reinforce lawful behaviour are essential. Equally 
important are the organization’s continuing efforts 
to improve its policies and procedures and ensure 
employees know and live up to them. 
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My staff also developed and refined procedures for 
examining and testing CSE’s information holdings, 
to ensure that those holdings contain only 
information that CSE is authorized to retain. This 
testing program is described in more detail below. 


Technology, CSE’s signals intelligence work depends on 
Privacy and sophisticated technology for its success. 
. This presents challenges for the organization. 

Review On the one hand, operating in a field where 
technology is advancing rapidly, CSE must upgrade 
its technology constantly to meet the government’s 
foreign intelligence requirements. On the other 
hand, the rapid pace of technological change 
presents CSE with a particular challenge in 
protecting the rights of Canadians, since new 
technologies can expand CSE’s capabilities. 


The sophistication of CSE’s technology has led to 
speculation about the organization’s capability to 
intercept the communications of Canadians. 
However, I have observed that CSE’s activities are 
driven not by the capabilities of the technology it 
deploys but by its mandate to fulfil the foreign 
intelligence requirements established by the 
Government of Canada. My review and analysis 
indicate that CSE is not using its technology to target 
Canadian communications. In keeping with the 
policy of the government, CSE goes to considerable 
effort to avoid collecting Canadian 
communications. 


Technology can, of course, be used to protect 
privacy. As CSE’s technological capabilities 
progress, its ability to avoid collecting information 
that does not advance its foreign intelligence 
mandate increases. New technologies can help CSE 
improve intelligence collection and support the 
organization’s lawfulness. I will continue to 
examine carefully CSE’s use of technology in the 
months and years ahead. 
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The Effect of 
Review on CSE 


1998-99 
Activities 
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In my last report, I cited a generally held view that 
observation prompts change. In other words, 

the very presence in an organization of external 
observers of performance can increase the internal 
commitment to improve that performance. 


In the case of an intelligence agency, effective 
performance is a function of the professed values 
of the organization, the activities it undertakes to 
achieve results, and its commitment to hold itself 
accountable for both its values and its results. 


During my first mandate I observed that the precept 
that observation prompts change applies to CSE. 

In my assessments of the agency, I examined not 
only CSE’s activities but also its values, as 
articulated in its policies and procedures. I can 
confirm that the presence of a review function is 
contributing to the momentum for improvement 
and serves as a reminder to employees of the values 
that CSE has articulated. 


A further benefit of the review function has been 
that CSE’s employees, knowing independent 
reviewers have informed the public that CsE’s 
activities are lawful, have been able to approach 
their jobs with more confidence and thus better 
serve the Government of Canada. 


These, I believe, are important arguments in favour 
of a permanent review mechanism. 


Two major undertakings represented the bulk of my 
office’s work this past fiscal year. The first 
revolved around testing the information in CSE’s 
databases. The second involved research and 
information gathering in support of the complaints 
function, which has now been fully integrated into 
my new mandate. 


Testing 


During the period under review, my staff devoted 
considerable effort to testing CSE’s signals 
intelligence databases. CSE analysts search these 
electronic files daily to identify intelligence that 
meets the government’s foreign and defence 
priorities. They then process and distribute this 
intelligence to CSE’s client departments and 
agencies within the government. My staff’s 
unlimited access to these holdings, therefore, 
provides my office with a direct passageway into 
the principal product of CSE’s SIGINT collection 
efforts — and the ideal mechanism to test the 
lawfulness of CSE’s collection activities. 


Our approach to testing remains a work in progress. 
It is under continual development and refinement, 
not only as our knowledge and understanding of 
CSE deepen, but also in response to technological 
advancements, changing collection practices and 
evolving intelligence priorities. 


Our testing is directed at determining whether CSE 
acts in accordance with the fundamental principles 
of lawfulness and privacy. In conducting our tests, 
we are constantly aware of a series of facts about 
the organization. For example: 


° CSE 1s both a collector of foreign communications 
intercepts and a recipient of communications 
intercepts collected by Second Parties; ” 


¢ CSE does not have the authority to target the 
communications of Canadians; 


e Canadian communications can make their way 
into CSE’s information holdings, since absolute 
exclusion is technically impossible at this time; 


° CSE uses the technical means at its disposal to 
reduce the inadvertent interception of Canadian 
communications; 


* Australia, New Zealand, United Kingdom, United States. 
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* CSE has policies and practices to address the 
safeguarding and proper handling of inadvertently 
collected Canadian communications in 
accordance with the laws of Canada, including the 
Privacy Act, the Criminal Code and the Canadian 
Charter of Rights and Freedoms. 


These facts about CSE have led me to establish 
several objectives for our testing program, 
including: 


¢ to determine whether CSE targets or possesses 
Canadian communications; 


¢ to review and assess CSE’s adherence to policies 
and practices on the handling of the 
communications of Canadians in accordance 
with the laws of Canada; and 


¢ to assess the comprehensiveness and effectiveness 
of the technical means used to safeguard the 
privacy of Canadian communications. 


As a result of our testing program, my staff has 
regular contact with CSE employees and continuous 
access to the organization’s information holdings. 
The testing function complements and verifies my 
office’s other methods for assessing compliance 
issues related to lawfulness and privacy. And the 
very presence of my staff as they conduct our tests 
onsite at CSE is a visible reminder to CSE’s 
operational staff of the legal boundaries within 
which they must operate. 


The Complaints Readers of my two earlier reports will recall that I 
Function expressed concern about complaints. In brief, 

while the 1996 Order in Council authorized me to 
receive complaints about CSE’s mandated activities, 
I lacked the authority to report to individual 
complainants about my findings. Instead, I had to 
suggest to complainants that they draw their own 
conclusions about my findings from the contents of 
my annual reports. 
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This matter is now rectified. The Order in Council 
that will guide my activities from June 19, 1999 to 
June 19, 2002 includes a provision by which I may 
receive, examine and report back on a complaint 
laid by any individual who is a Canadian citizen or a 
permanent resident of Canada. I look forward to 
operating under these new terms of reference. 
Although the comprehensiveness of the work of my 
office will not change, I am now able to respond 
directly to individuals about my findings. It remains 
my intention, however, not to examine allegations of 
wrongdoing with respect to incidents that took place 
before my original appointment on June 19, 1996. 


In anticipation of this enhancement, in August 1998, 
my office sought advice and embarked on a series of 
studies to determine the budgetary, staffing and 
administrative implications of an integrated 
complaints function. I wanted to learn as well about 
the best practices of others whose responsibilities 
include receiving and examining complaints and 
responding to complainants, both in Canada and 
abroad. 


Although I have received several complaints since 
1996, I have no way of knowing whether the 
number or nature of complaints will change with 
the revised mandate. However, I do have a few 
objectives for the function itself. I want an 
approach based on sound systems and practices that 
can be expanded or contracted as needed, depending 
on the number of files involved. I want to ensure 
that current dispute resolution mechanisms and 
practices are featured. I want to avoid creating an 
administrative burden for CSE and my office and to 
keep bureaucracy and paperwork to a minimum. 


When we began to examine other complaints 
functions, it was clear that any study would require 
a careful focus, since myriad examples exist. 

We chose to review the policies and practices of 
six other federal offices that handle complaints and 
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investigations resulting from the actions or inactions 
of another agency or department of government. 

We also studied how complaints are handled by 
other jurisdictions, including the United Kingdom, 
Australia and New Zealand. 


I am grateful to many people who gave generously 
of their time and experience, including officials at 
the offices of the Correctional Investigator, the 
Information Commissioner, the Official Languages 
Commissioner, the Privacy Commissioner, the RCMP 
Public Complaints Commission, and the Security 
Intelligence Review Committee. As a result of this 
effort, I expect that the transition to my new 
mandate will be a smooth one. 


Other Activities In August 1998, I testified before the Special 
Senate Committee on Security and Intelligence, 
chaired by Senator William M. Kelly. In my 
remarks, I described the work of my office and the 
options for long-term review of CSE. I was pleased 
with the Committee’s recommendation, in its 
January 1999 report, that CSE should have its own 
Act of Parliament and that the legislation should 
provide for a permanent and separate review body 
for CSE. 


Back in 1996, the Auditor General conducted an 
audit of the Canadian intelligence community. 

This past December, he issued a short follow-up 
report to the 1996 study. In his generally positive 
comments about the community’s response to his 
report, he reiterated his view that legislation for CSE 
could be of value. 


Shortly after the end of the 1998-99 fiscal year, CSE 
sponsored its first ever Law Day. The event 
coincided with other Law Day celebrations across 
the country held annually to mark the anniversary 
of Canada’s Charter of Rights and Freedoms. I was 
pleased to participate in the event at CSE, where I 
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spoke to a large gathering of employees about the 
role of my office in determining whether the 
activities of CSE are lawful. I noted that the creation 
of a review function for CSE grew out of Canadians’ 
increased awareness of the rights of individuals, an 
awareness reflected in the Charter. The recent 
creation of review functions for security and 
intelligence agencies in similar democratic 
countries, such as the United Kingdom, Australia 
and New Zealand, suggests that our experience in 
Canada is not unique. 


Budget and Staff When the government established my office, it 
allocated an annual budget of approximately 
$500,000, including salaries. In addition to paying 
for the usual costs of running an office, I chose to 
hire two full-time staff and to bring in several 
subject-area specialists on contract. This approach 
allowed me to have at hand the range of expertise 
required to fulfil my mandate. 


I can report that total spending for the three years 
was $1.117 million, well within the budget. 
Annex B to this report provides a statement of my 
expenditures over the course of the first mandate. 


1998-99 While our methods for reviewing CSE’s activities 
r y have become more sophisticated and have allowed 

Findings us to delve more deeply into the organization, our 
findings have not changed. Based on the results of 
our review and analysis, I am of the opinion that 
CSE has acted lawfully in the performance of its 
mandated activities during the 1998-99 review 
period. I am also satisfied that CSE has not targeted 
the communications of Canadian citizens or 
permanent residents of Canada. 


During 1998-99, I submitted three classified reports 


to the Minister of National Defence, bringing to 
seven the number of such reports submitted during 


10 ANNUAL REPORT 1998-1999 


Operational 
Policy 
Revisited 


my first mandate. These reports examined some 
aspect of CSE’s SIGINT and ITS activities. None of 
my Classified reports brought to the Minister’s 
attention incidents of unlawful activity on the part 
of CSE. 


In my last report, I noted that I had reviewed the 
operational policies in place at CSE to determine 
whether they provided adequate guidance to 
employees in the performance of their duties. 

I also indicated my particular interest in policies 
related to privacy issues. 


I concluded then that there was an appreciable 
amount of sound operational policy in place at CSE 
and that there were no policy gaps on matters of 
lawfulness or privacy. I did observe, however, that 
policy was not always at the right organizational 
level. While this is not always an easy call to 
make, a useful test 1s to examine whether the level 
of the individual with the authority to change a 
policy is appropriate to the importance of the 
policy. In other words, the most important policies 
should be alterable only at the highest levels of 
authority. 


During this reporting year, CSE undertook to 
restructure its internal policy development process. 
With the approval and support of the senior 
management team, CSE adopted a new framework 
for policy authority, accountability and 
coordination. The framework, which was approved 
in late 1998, identifies the appropriate level of 
authority for various policies and provides a 
desirable level of operational flexibility in support 
of day-to-day activities. 


This is a welcome initiative and, once it is fully in 
place, I plan to examine its effect on the policies 
and derivative practices that address issues of 
lawfulness. 
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On several occasions, I have expressed the view 
that CSE should have its own legislation. 
Legislation would put the agency on a firm footing 
by articulating its mandate and powers and its 
relationships with Parliament, the Government, and 
the Minister of National Defence. It would seem 
reasonable to expect that provisions for a 
permanent review mechanism would also be 
included. 


Some observers have suggested that the activities of 
Canada’s foreign signals intelligence agency and its 
domestic security intelligence agency could be 
examined by the same review mechanism. 

In defence of this idea, they cite such advantages 

as economies of scale. I am not a supporter of this 
proposal, however, for a number of reasons. 


First, the mandates of the two agencies in question 
are markedly different: one provides the 
government with information and advice on threats 
to national security, while the other provides 
foreign signals intelligence in support of the 
government’s foreign and defence policies. 
Second, the agencies report to Parliament through 
different ministers of the Crown, as do the bodies 
that now review their activities. 


These are not the most compelling reasons, 
however. 


In the three years I have spent as CSE Commissioner, 
I have concluded that a fundamental distinction 
must be made between the activities of a domestic 
intelligence agency and those of a foreign 
intelligence agency such as CSE. This distinction 
must also be reflected in both the ethos and the 
undertakings of the bodies responsible for reviewing 
them. The need to distinguish between the two 
stems directly from the unique relationship between 
each agency and the citizens of the country it serves. 


To fulfil its mandate, a domestic intelligence 
agency must maintain constant contact with the 
citizens of the nation, through programs of varying 
degrees of intrusiveness, designed to collect 
intelligence about threats to security within its 
borders. The mandate of its corresponding review 
body must therefore be broad-based, reflecting the 
reality that this relationship is sensitive, ongoing, 
and at the core of the agency’s activities. 


CSE, on the other hand, has no such relationship 
with Canadians. It relies on a variety of 
sophisticated technologies to fulfil its SIGINT 
mandate. Its activities serve the interests of 
Canadians by collecting intelligence from outside 
Canada’s borders in relation to the government’s 
foreign and defence priorities. Appropriately, my 
review mandate relates directly to the lawfulness of 
CSE’S activities. 


I have concluded that the most important feature of 
any review mechanism is to provide assurance to 
the appropriate minister, to Parliament and, 
ultimately, to the public. This assurance should be 
based on careful examination of the activities at the 
heart of the agency under review. In this regard, I 
believe the current review arrangements, although 
perhaps not the ultimate review solution, serve 
Canadians well. 


During the course of the period under review, 
Farewell Mr. Stewart Woolner, Chief of CSE, retired from the 

public service. During his 37 years with CSE, 

Mr. Woolner oversaw many significant changes in 

the organization and its operating environment, 

including the introduction of my review function. 

I want to take this opportunity to express my 

appreciation for his cooperation and professionalism 

and to signal his unique dedication to the work CSE 

performs on behalf of the people of Canada. 
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TO 
Behe oe «t ih) A 


PA 10968090 


PRIVY COUNCIL @ CONSEIL PRIVÉ June wiley 1906 


His Excellency the Governor General in 
Council, on the recommendation of the Minister of 
National Defence, pursuant to Part II of the Inquiries 
Act, hereby authorizes the Minister of National Defence 
("Minister"): 


(a) to appoint the Honourable Claude Bisson of 
Montreal, Quebec, for a period of three years, as 
a commissioner ("Commissioner") to review the 
activities of the Communications Security 
Establishment ("CSE") for the purpose of 
determining whether those activities are in 
compliance with the law; 


(b) to direct the Commissioner to submit to the 
Minister, once each year and in both official 
languages, a report on the Commissioner's 
activities and findings that are not of a 
classified nature, which report the Minister will 
table in Parliament; 


(c) to authorize the Commissioner, at any time the 
Commissioner considers it advisable, to submit a 
report containing classified information to the 
Minister; 


(d) to direct the Commissioner to advise the 
Minister and the Attorney General of Canada of any 
activity of CSE that the Commissioner believes may 
not be in compliance with the law; 


(e) to direct the Commissioner not to review 
issues for which other avenues of redress are 
established by statute; 


1e 
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(f) to require that the Commissioner and all 
persons engaged on his behalf take an oath of 
secrecy and comply with all applicable government 
security requirements; 


(g) to direct the Commissioner, before submission 
of any report to the Minister, to consult with the 
Deputy Clerk, Security and Intelligence, and 
Counsel at the Privy Council Office for the 
purpose of ensuring compliance with all security 
requirements and preservation of the secrecy of 
sources of security and intelligence information 
and of the security of information provided to 
Canada in confidence by other nations; 


(h) to authorize the Commissioner to engage the 
services of such staff and technical advisors as 
he considers necessary to assist him in his 
review, at such rates of remuneration and 
reimbursement as may be approved by the Treasury 
Board; 


(i) to fix the remuneration of the Commissioner at 
the per diem rate set out in the schedule hereto, 
which rate is within the range of $400 to $500; 
and 


(j) to authorize that the Commissioner be 
reimbursed for his actual transportation expenses 
and a non-accountable living allowance of up to 
$175 per diem while in travel status away from his 
normal place of residence in connection with the 
conduct of this review. 


CERTIFIED TO BE A TRUE COPY - COPIE CERTIFIEE CONFORME 


CLERK OF THE PRIVY COUNCIL - LE GREFFIER DU CONSEIL PRIVE 
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Salaries and Wages 


Transportation 
and Telecommunications 


Information 
Professional and Special Services 
Rentals 


Purchased Repair 
and Maintenance 


Materials and Supplies 
Acquisition of Equipment 


Miscellaneous 


* represents partial year 
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A New 
Mandate 


For the past four years I have had the responsibility 
of reviewing the activities of the Communications 
Security Establishment (CSE) and reporting to the 
Minister of National Defence on the lawfulness of 
those activities. 


My initial three-year mandate was set out in a 1996 
Order in Council of the Government of Canada 
under the Inquiries Act. On June 15, 1999, the 
Minister of National Defence announced that the 
government had renewed my appointment for 
another three years and enhanced my mandate by 
increasing my authority to respond to complaints 
about CSE. A copy of the new Order in Council 
appears as Annex A of this report. 


This Annual Report — my fourth — covers the first 
year of my second mandate, up to the government’s 
fiscal year end of March 31, 2000. 


The task of reviewing CSE is an important and 
necessary one in a democratic society. An agency 
of Canada’s Department of National Defence, CSE 
provides the Government of Canada with foreign 
signals intelligence (SIGINT), which it obtains by 
gathering and analyzing foreign radio, radar and 
other electronic emissions. Through its Information 
Technology Security program, CSE also provides 
advice on the security of the government’s 
information technology. 


To fulfil its mandate, CSE has, over the more than 
five decades of its existence, developed highly 
sophisticated technological capabilities. One of my 
functions is to review CSE’s activities to ensure that 
the organization does not use its capabilities in 
ways that contravene the laws of Canada. 
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1999-2000 
Review 
Undertakings 


Infernal 
Investigations and 
Complaints 


Foreign Signals 
Intelligence 


During this past year, I submitted four classified 
reports to the Minister of National Defence. 

One of these reports revisited the subject of internal 
investigations and complaints. The remaining 
reports presented the results of reviews of CSE 
activities related to its foreign signals intelligence 
and information technology security mandates. 
All studies included an examination of the legal 
parameters within which CSE operates, related 
policies and practices, and the accountability 
systems and procedures in place at CSE. None 
revealed issues of unlawful activity. 


When I first reviewed CSE’s internal investigations 
and complaints in 1997-98, I observed that most 
dealt with such issues as security infractions, and 
none involved unlawful activity in the delivery of 
CSE’s mandate. This was again the case this past 
year. In the interim, CSE implemented many new 
internal security policies and initiatives to heighten 
security awareness. These appear to have proven 
effective, in that there were far fewer incidents 
leading to internal investigations this past year than 
in 1997-98. 


In reviewing CSE’s signals intelligence activities 
this past year, I noted a continuing enhancement 
and updating of SIGINT policies and directives 

in response to the evolving communications 
environment. I also observed new initiatives 
introduced by CSE to enhance its ability to manage 
and account for its SIGINT-related activities. 


I paid particular attention this year to examining not 
only what CSE collects and retains, but how CSE’s 
intelligence holdings are generated. As a result, I was 
able to further my knowledge and understanding of 
some of the highly specialized and technical means 
used to minimize the likelihood that private Canadian 
communications would make their way into CSE’s 
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holdings. I am able to state that, as of this date, 
I am satisfied that, within the current technical 
environment, CSE is employing appropriate 
measures to safeguard the privacy of Canadians. 


The Intelligence Cycle In last year’s report, I observed that CSE’s activities 
are driven by its mandate to fulfil the foreign 
intelligence requirements established by the 
Government of Canada, not by the capabilities 
of the technology at hand. 


Those requirements, in the form of foreign 
intelligence priorities for Canada’s intelligence 
community, are set annually by a group of Cabinet 
ministers whose responsibilities touch on the 
country’s security within Canada and abroad. 

The establishment of the Government of Canada’s 
intelligence priorities is the first step in what the 
intelligence community calls the “intelligence 
cycle.” Itis worth examining that cycle briefly 
and looking at CSE’s role in it. 


The Government of Canada’s foreign intelligence 
priorities form the basis of CSE’s yearly SIGINT 
program. That is to say, these priorities are 
conveyed formally to CSE by the Deputy Secretary 
to the Cabinet, Security and Intelligence, Privy 
Council Office. CSE then uses these priorities to 
determine what information it seeks to obtain, 
either from its own activities or from the activities 
of its partner agencies in the United States, the 
United Kingdom, Australia, and New Zealand. 


Concurrent with this, CSE must ensure that the 
appropriate steps are always taken to minimize the 
likelihood of intercepting the private 
communications of Canadians. 


Next, CSE receives the inflow of intelligence traffic 


from multiple sources — its own and those of its 
partners. This traffic is then processed, analyzed 
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and assessed against the government’s intelligence 
priorities. The resulting intelligence product is 
disseminated to the government departments 
responsible for protecting Canada’s security, 
intelligence, economic and defence interests. 


Intelligence dissemination is facilitated by 
knowledgeable CSE staff who provide a tailored 
and timely intelligence delivery service to some 
800 senior decision makers in government on 
ongoing and emerging issues. This regular contact 
with the users of CSE’s intelligence product 
ensures that requirements are updated and feedback 
is incorporated in the production process. 


The intelligence cycle provides me with one 
framework for reviewing CSE’s activities. I can 
examine the lawfulness of CSE’s activities at each 
stage of the cycle. Through this work, I keep 
abreast of foreign intelligence collection 
capabilities and practices, signals processing, 
signals and intelligence analysis, and the 
dissemination of intelligence product to CSE’s 
clients in government. 


I believe the exploding yield of information carried 
by global communications networks increases the 
need to ensure that the privacy of Canadians is 
protected. I continue working to identify and 
understand the numerous technological initiatives 
that support intelligence gathering. I am also 
increasing my understanding of how some of these 
initiatives are applied. Within this intelligence 
cycle, however, my interest remains the 
identification and examination of any technical 
applications and initiatives CSE uses to avoid, or at 
least minimize, the likelihood of private Canadian 
communications making their way into CSE’s 
holdings. 
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I am able to report that CSE has undertaken 
initiatives to advance its technological capability 

to ensure the protection of private Canadian 
communications. CSE is aware of both my interest 
in this area and the importance I attach to assessing 
compliance. I encourage CSE’s research and 
development initiatives in this fast-paced 
technological environment. 


‘Second Party’ As noted earlier, CSE receives signals intelligence 

Collection gathered by other governments. CSE also 
contributes intelligence it collects to other 
governments. These partnership arrangements — 
with the United States, the United Kingdom, 
Australia, and New Zealand — were developed 
during the Second World War and maintained 
throughout the Cold War. Signals that are provided 
by one country to another are described as “second 
party’ collection. 


The governments of the countries involved in this 
exchange of intelligence have policies to ensure the 
privacy of their citizens. In particular, each 
government has agreed not to undertake collection 
on behalf of a second party that would be illegal in 
the second party country. In other words, they do 
not do indirectly what they cannot do directly. 


I have made a point of developing an understanding 
of these collaborative relationships, focusing not 
only on shared policies but also on actual practices. 
I have sampled the documentation and had access 
to some of the systems that support intelligence 
gathering and exchange. At this time I am satisfied 
that CSE is taking all reasonable steps to safeguard 
the privacy of Canadian communications. 
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Information Over the past four years, I have focused much of 
my effort on CSE’s SIGINT activities. However, 
sea vires 2 CSE has another important role in government — its 
ecurity Information Technology Security (ITS) mandate: 
CSE advises the government on how to maintain 
security in its use of information technology. 


This year, my Office conducted an in-depth 
examination of the ITS program to determine 
whether its activities were lawful. The study 
involved, first, a review of CSE’s ITS authorities 
and mandate as provided in direction given to the 
Chief, CSE. This was followed by an examination 
of the management control framework established 
to govern the conduct and performance of ITS 
activities. Step three was an analysis of the 
environmental factors and changing circumstances 
affecting the government’s security requirements. 
Finally, strategies, plans, operations and projects 
were reviewed against the template established by 
the preceding steps to identify issues or activities 
for further exploration. 


No evidence of unlawful activity was found. 
However, the study did reveal several pertinent 
facts: 


e The trend in government and the private sector 
toward increased electronic business and service 
delivery is radically transforming the ITS 
program. Whereas previously the program’s 
focus was the protection of classified information 
about a small number of government clients, 
now it is called upon increasingly to advise on 
protecting unclassified but sensitive information, 
including the electronic business transactions 
that underpin many government programs and 
operations. 


e If Canadians are to have confidence in electronic 
commerce and the infrastructure that makes it 
possible, the government must have “made-in- 
Canada” solutions to security concerns. CSE is 
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well equipped to play a key role in this, but it 
must be given clear direction by government on 
this sensitive issue. 


¢ For example, one effective means of confirming 
the security of information infrastructure is to 
attempt to penetrate the defences (e.g., to test so- 
called firewalls). This is called “ethical hacking.” 
CSE does not conduct such penetrations of active 
systems because this could reveal personal data, 
with privacy implications. However, the result is 
that mission-critical information technology 
systems are not tested for the full range of threat 
scenarios facing those systems. 


Henceforth, I will closely monitor ITS involvement 
in these activities to ensure they comply with 
prevailing constraints. I also would encourage the 
government to give CSE clear policy direction 
regarding the role it should play in ensuring the 
security of Canada’s information infrastructure. 


Budget and My annual budget allocation for the year 1999- 
Staff 2000 was augmented to $635,500 to provide for 


additional expenses, including counsel, in support 
of my expanded complaints function. I can report 
that actual expenses incurred were within budget. 


In addition to two full-time staff, I have continued 
the practice established during my first mandate 
of hiring subject matter experts under contract. 

At present, I have six contractors performing 
specialized work under this arrangement, all of 
whom have been security cleared for the purpose 
of their work. 


As I have indicated in the past, I believe I have 


adequate financial and personnel resources to carry 
out the mandate I have been given. 
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1999-2000 
Findings 


Based on the results of our review and analysis, I 
am of the opinion that CSE has acted lawfully in 
the performance of its mandated activities for the 
period under review. I am also satisfied that CSE 
has not targeted the communications of Canadian 
citizens or permanent residents of Canada. 


These findings are consistent with those from 
previous years, since the creation of this Office. 
Through the process of study and review, I am 
advancing my knowledge and understanding of 
how CSE conducts its mandated activities. As my 
depth of knowledge increases, so does the certainty 
of my approach to assessing the lawfulness of these 
activities. Of particular importance to me is the 
increasing confidence with which I can state my 
findings. 


By their very nature, foreign intelligence activities 
raise questions, and sometimes concerns, on the 
part of the private citizen. And I can attest to the 
technical, legal and ethical complexity of the 
intelligence cycle. I believe, therefore, that the 
existence of my Office since 1996 has been a 
necessary and appropriate addition to Canada’s 
intelligence community. It has been my experience 
that, since 1996, CSE’s policies, procedures and, 
most important, its practices have reflected the 
presence of my Office and my review parameters as 
established by the Government of Canada. 


This combination of advancing capabilities on 

the part of my Office and improved policies and 
practices on the part of CSE augurs well for the 
future. Nevertheless, I intend to remain vigilant in 
reviewing the activities of CSE, and I will ensure 
that our increasing abilities are applied robustly as 
I fulfil the responsibilities of this Office. 


ANNUAL REPORT 1999-2000 


The 
Complaints 
Function 


Anonymous 
Allegations 


This was the first year in which I had the authority to 
respond directly to individuals who raise complaints 
about CSE’s activities. Previously, under my original 
mandate, I could receive such complaints but I was 
not able to report to the complainants about my 
findings. I was pleased when this limitation was 
removed when my mandate was renewed. 


To help members of the public understand the role of 
my Office, and in particular the complaints function, 
we published a brochure, Safeguarding the Privacy 
of Canadians. The brochure notes that because 
complaints may contain sensitive information or 
may affect the privacy of Canadians, my Office will 
accept complaints only by mail, addressed to me. 
Copies of the brochure are available upon request. 


My background and training in arbitration and 
mediation before I became Commissioner have 
made me a strong advocate of the benefits of 
alternative dispute resolution. By bringing the 
two sides to a dispute together to seek a mutual 
solution, alternative dispute resolution can reduce 
both conflict and costs and lead to a settlement that 
leaves both sides satisfied. For this reason, 

I have incorporated alternative dispute resolution 
processes into the Office’s mechanisms for 
addressing complaints. 


During the past year, I responded to a number of 
enquiries from concerned individuals. I can report, 
however, that no formal complaints were received 
by my Office. 


One option open to me in reviewing the activities 
of CSE is to guarantee anonymity to people, 
particularly current or former employees, who 
come to me with allegations of illegal activity by 
CSE. Some observers believe such an offer would 
enhance my ability to determine whether such 
activities were taking place. 
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I do not believe guaranteed anonymity for accusers 
is the right way to go. This approach would have 
the potential to poison the operating environment 
at CSE, or at any other institution with such a 
guarantee. Managers and co-workers could easily 
become reluctant to offer necessary criticisms and 
critiques of the work of other employees for fear 
that an offended employee could make anonymous 
unfounded accusations against them. 


For these reasons, the complaints procedures I have 
established for this Office do not shield the identity 
of people who bring forth allegations of 1llegal 
activity by CSE. It is my belief that, by putting the 
appropriate mechanisms in place in an environment 
designed to address issues constructively, 
complainants will feel compelled to come forward, 
in good faith, to raise legitimate concerns. At the 
same time, I will not hesitate to use all the authority 
of my Office to ensure that complainants acting in 
good faith do not suffer reprisals from any quarter, 
regardless of the ultimate disposition of the issues 
they raise. 


lei The ability of my Office to review the activities of 
B uilding CSE can be enhanced by the relationships we have 
ReEIATIONSNIPS with stakeholders beyond CSE itself. During 1999- 
2000, two developments served to strengthen this 
Office’s relationships with others. 


DND Ombudsman In June 1999, the Minister of National Defence 
announced the mandate of André Marin, the 
Ombudsman for the Department of National 
Defence (DND) and the Canadian Forces. The 
Ombudsman is designated to act on the Minister’s 
behalf, independent of the chain of command, as a 
neutral and objective sounding board, mediator and 
reporter on matters related to the Department of 
National Defence and the Canadian Forces. 
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Because the Communications Security Establishment 
is an agency of DND, there is potential overlap 
between my role and that of the Ombudsman. In the 
autumn of 1999, Mr. Marin and I met to discuss our 
respective mandates as well as to establish clear 
boundaries and procedures for cooperation between 
our two Offices. We agreed the Ombudsman has an 
important role in addressing issues raised by CSE 
employees, but that role does not extend to activities 
related to the mandate of CSE. In other words, it is 
my responsibility to deal with issues involving CSE’s 
SIGINT or ITS activities. 


We are confident that, between the two of us, 
we can effectively and efficiently address any 
concerns that may arise about CSE. 


international At the international level, the second conference of 

Conference Inspectors-General and Review Agencies, which 
took place in Ottawa in June 1999, gave me an 
opportunity to discuss mutual interests with 
colleagues from Australia, New Zealand, the United 
Kingdom, the United States, Belgium and South 
Africa. The event was hosted by Canada’s Security 
Intelligence Review Committee, the agency 
responsible for reviewing the Canadian Security 
Intelligence Service. The first such conference took 
place in Canberra, Australia in 1997. 


Among the topics of discussion at the conference 
were relations between review organizations and 
legislators, and relationships with the media. 

The participation of Canadian parliamentarians 
and journalists made these sessions particularly 
informative. Equally valuable were the formal 
and informal exchanges with people from other 
countries who have responsibilities similar to my 
own. By comparing experiences, we learned how 
others have addressed the challenges we share. 
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The Futu re of In prepared remarks to the conference of 
Inspectors-General and Review Agencies, I noted 


Review for CSE that over the past decade or two, many of our 
governments have increased their efforts to monitor 
and report on the lawfulness of their intelligence 
agencies — a trend I said was likely to continue. 
Government actions in this regard have been 
deliberate and carefully thought out, in keeping 
with the importance and sensitivity of intelligence 
activities, but the direction is clearly toward greater 
openness and increased accountability. 


I noted that a key issue in the Canadian context 

is whether the Government of Canada should 
introduce legislation for CSE. I observed that any 
such legislation would likely include the creation 
of a permanent review mechanism in place of my 
fixed-term appointment by Order in Council. 


As [have said before, I believe that legislation 
for CSE would be an appropriate development. 
However, if and when the government decides to 
move in this direction, it should act with the same 
caution and deliberation that have been the 
hallmarks of western governments in dealing 
with their intelligence agencies. In my view, the 
arrangements now in place to review CSE are 
entirely effective, and there is no urgency to alter 
them independent of the larger issue of whether 
CSE should have a legislative base. Permanent 
review arrangements should reflect the foreign 
intelligence nature of the work of CSE and the 
degree to which CSE could infringe on the rights 
and privacy of Canadians in fulfilling its mandate. 
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My New 
Website 


People and 
Places 


Last year saw the launch of the official website 

of the Office of the Communications Security 
Establishment Commissioner. My objective with 

the site is to make information about this Office more 
readily available to the growing number of Canadians 
with access to the Internet. The site provides 
background on the mandate and functions of the 
Commissioner and access to my annual reports. 

The website address is http://csec-ccst.gc.ca. 


One of the challenges facing CSE in the past was 
that its employees were scattered in several buildings 
in Ottawa. That situation improved with the recent 
acquisition of the former Canadian Broadcasting 
Corporation headquarters, which is close to the main 
CSE facility, the Sir Leonard Tilley Building. 

The new building — now named the Edward Drake 
Building in honour of the first head of CSE’s 
predecessor organization, the Communications 
Branch of the National Research Council — will 
allow CSE to consolidate most of its operations in 
the two buildings, under the leadership of its new 
Chief, Mr. D. Ian Glen. 


On a separate note, the government and the people 
of Canada lost an outstanding public servant with 
the death in August 1999 of Mr. John Tait. I had 
the honour of knowing Mr. Tait when he was 
Deputy Minister of Justice and I was Chief Justice 
of Quebec. When I took on this job, he was the 
Coordinator of Security and Intelligence in the 
Privy Council Office and thereby the Deputy 
Minister responsible for CSE’s policy and 
operations. Among his many other contributions to 
the government was a 1997 report on public service 
values and ethics, produced by a task force that he 
chaired. The document, now widely known as the 
Tait Report, has helped generate a strengthening of 
values-based governance in the Government of 
Canada. 
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P.C. 1999-1048 
June 8, 1999 


CANADA 


PRIVY COUNCIL e CONSEIL PRIVÉ 


His Excellency the Governor General in 


Council, “on the recommendation of ‘the Minister of 
National Derence, "pursuant ‘tol Part Divot "the Wnigisries 


hereby authorizes the Minister of National Defence 


(in this order referred to as "the Minister") 


(a) to re-appoint the Honourable 

Claude’ Bisson of Montreal, Quebec)" fora period of 
three years, aS a commissioner ("the 
Commissioner") to review the activities of the 
Communications Security Establishment (“CSE”) for 
the purpose of determining whether those 
activities are in compliance with the law; 


(Db) “Co authorize the Commissioner toe’ commence that 
review on his own initiative or at the request of 
the Minister; 


(c) to authorize the Commissioner to investigate 
any complaint, concerning the lawfulness of CSE 
activities, made by any individual who is a 
Canadian citizen or a permanent resident of 
Canada; 


(d) to authorize the Commissioner not to 
investigate complaints for which, in the 
Commissioner’s opinion, other avenues of redress 
are established by statute; 


(e) to specifically authorize the Commissioner to 
inform any complainant of the results of his 
investigation, ensuring that no classified 
information is disclosed to the complainant; 


(fF) to divect the Commissioner to inform the 
Minister and the Attorney General of Canada of any 


CSE activity that the Commissioner believes may 
not be in compliance with the law; 


eee: 
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(g) to direct the Commissioner to submit to the 
Minister, once each year and in both official 
languages, a report on the Commissioner’s 
activities and findings that are not,classified, 
which report the Minister will table in 
Parliament; 


(h) to authorize the Commissioner, at any time the 
Commissioner considers it advisable, to submit a 
report containing classified information to the 
Minister; 


(1) to direct the Commissioner, before submitting 
any report to the Minister, to consult with the 
Deputy Secretary to the Cabinet (Security and 
Intelligence) at the Privy Council Office for the 
purpose of ensuring compliance with all security 
requirements and the preservation of the secrecy 
of sources of security and intelligence 
information and of the security of information 
provided to Canada in confidence by other nations; 


(j) to direct the Commissioner and all persons 
engaged on his behalf take an oath of secrecy and 
comply with all applicable government security 
requirements; 


(k) to authorize the Commissioner to engage the 
services of any staff, advisors and counsel that 
he considers necessary to assist him in the 
performance of his duties and functions at such 
rates of remuneration and reimbursement as may be 
approved by the Treasury Board; 


my 


ANNEX 


P.C. 1999-1048 


(1) to fix the remuneration of the Commissioner at 
the per diem rate set out in the annexed schedule, 
which rate is within the range of $400 to $500; 


and 

(m) to authorize that the Commissioner be paid 
reasonable travel and living expenses incurred by 
him in the performance of his duties and functions 
while absent from his ordinary place of residence, 
in accordance with Treasury Board travel 
directives; 


effective“ June 19, 1999. 


CERTIFIED TO BE A TRUE COPY-COPIE CERTIFIEE CONFORME 


CLERK OF THE PRIVY COUNCIL-LE GREFFIER DU CONSEIL PRIVÉ 
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Dear Mr. Eggleton: 
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INTRODUCTION 


In the five-year period since my appointment, 

I have observed the emergence of complex global 
communications technologies, together with 
evolving political, social and economic realities. 
This environment has led to the identification of 
new threats to Canada’s security, defence and 
national interests and a pressing need for the 
Government of Canada to determine how to counter 
these threats. 


During this same period, the Communications 
Security Establishment (CSE) has sought to maintain 
its ability to meet the government’s evolving foreign 
intelligence priorities and to protect the integrity of 
its communications and information systems. 


I believe that a failure to maintain CSE’s capabilities 
would have serious implications for Canada’s 
national interests. For example, if CSE were unable 
to report on the activities and intentions of foreign 
states and persons, Canada’s political and economic 
well-being would be at risk. Furthermore, if CSE 
could no longer protect government information 
systems and assets, the government’s efforts would 
be crippled in the areas of electronic service delivery 
and e-commerce, ultimately to the detriment of 
Canada’s economic competitiveness. 


Technological advancements will certainly continue 
and may even accelerate. CSE’s senior 
management has informed me that they are 
convinced CSE must refocus its efforts to meet its 
responsibilities to government, or risk lagging 
behind. As a result, in consultation with its 
stakeholders, CSE has adopted a renewed strategic 
approach to its mandate. 


This is the environment in which I continue to 
examine CSE’s activities to determine their 
compliance with the laws of Canada and to assess 
CSE’s efforts to safeguard the privacy of Canadians. 
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CSE TODAY 


Mandate 


Signals 
Intelligence 


As in my previous annual reports, I will look back 
in this 2000-2001 Annual Report on CSE’s 
performance over the past year. 


CSE, an agency of the Department of National 
Defence, assists the Government of Canada in two 
distinct but related areas: 


e It provides the government with foreign 
intelligence by collecting, analyzing and 
reporting on foreign radio, radar and other 
electronic signals (signals intelligence, or 
SIGINT). 


e It helps ensure the Canadian government’s 
telecommunications and information 
technologies are secure from interception, 
disruption, manipulation or sabotage 
(information technology security, or ITS). 


The Minister of National Defence is fully 
accountable to Parliament for CSE. He is 
supported by two senior officials — the Deputy 
Minister of National Defence, for financial and 
administrative matters, and the Deputy Clerk of the 
Privy Council, Counsel and Security and 
Intelligence Coordinator, for policy and operational 
matters. 


CSE’s SIGINT program is guided by the foreign 
intelligence priorities established annually by the 
Meeting of Ministers on Security and Intelligence, 
chaired by the Prime Minister. 


To fulfill its SIGINT mandate, CSE acquires 
various modes of foreign communications signals. 
The collection and processing of these signals 
involve highly sophisticated and complex 
technologies. Processing often includes the 
decryption and translation of encrypted 
communications to make them intelligible. 
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Encryption falls within the science known as 
cryptology, which uses mathematical algorithms to 
hide or disguise communications. 


I have learned from CSE that advancements in 
global transmissions present continuing challenges 
to the collection and processing of foreign signals. 
The tremendous volume of communications signals 
produced every day, together with the increased use 
and public availability of encryption software, has 
added to these challenges. 


As aresult, CSE has dedicated additional resources 
to the research and development of techniques to 
acquire and process communications, so that the 
government can be kept apprised of threats to 
Canada’s interests. To accomplish this, CSE 

relies on the capabilities of a cross-section of 
skilled workers, including computer scientists, 
mathematicians and linguists. To produce 
intelligence reports it also needs analysts 
knowledgeable in such matters as international 
political, economic and military affairs, terrorism, 
and transnational crime. These reports are the 
vehicle through which CSE communicates foreign 
intelligence information to its Government of 
Canada clients. More than 100,000 SIGINT reports 
are made available to CSE’s readership every year. 


Information The development and application of new 
technologies in recent years has transformed the 
pie focus and complexity of the activities undertaken 
ecurity by CSE to protect government communications and 
communications systems, the mandate of its 
Information Security Technology (ITS) program. 


Until fairly recently, computer hardware, software 
and networks were not widely available and had 
limited application. Today, however, the computer 
is a fully established means of daily 


ANNUAL REPORT 2000-2001 3 


Relationships with 
allies 


Controls on CSE’s 
activities 
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communication among people. It drives many of 
the technologies that make up Canada’s critical 
information infrastructure. 


This communications environment has introduced 
new vulnerabilities to government information 
systems that require alternative solutions to counter 
threats to security and privacy. 


The government looks to CSE to protect 
information stored or transmitted on its computer 
systems while, at the same time, departments 

and agencies work toward making a multiplicity 
of services available to the public on-line. 
Meanwhile, by law, personal information about 
Canadians must be protected, despite the fact that 
government computer systems are increasingly 
interconnected and vulnerable to disruption and to 
such threats as denials of service. 


Canada benefits from longstanding arrangements 
between CSE and its counterparts in the United 
States, the United Kingdom, Australia, and New 
Zealand. These arrangements, which were 
formalized after the Second World War and 
maintained during the Cold War, allow for the 
exchange of signals intelligence, technology and 
information about sources and techniques of shared 
interest. 


As part of my ongoing review of CSE’s activities, I 
am satisfied that CSE does not use its partners to 
circumvent the laws of Canada, nor does it provide 
partners with communications they could not 
legally collect for themselves. 


Based upon my review activities to date, I have 
observed that CSE’s activities are guided by law 
and policy and the government’s priorities, not by 
its technical capabilities. In addition to my own 
reviews, CSE is also subject to the independent 


scrutiny of many, including the courts, the Privacy 
Commissioner, the Information Commissioner, the 
Canadian Human Rights Commission, and the 
Auditor General of Canada. 


Today’s global communications networks generate 
an inordinate volume of information with which 
CSE must contend. This volume is in and of itself a 
control. In practical terms, CSE must stay focused 
on its mandate in order to meet the foreign 
intelligence priorities it is given. 


CSE’s recent The government uses CSE’s intelligence reporting 
: - to further Canada’s economic and political interests 
contributions in its relationships with foreign states. 


The Canadian Forces enter peacekeeping 
operations abroad with an enhanced understanding 
of the situation on the ground as a result of CSE’s 
contributions. 


CSE provides its government clients responsible 
for protecting public safety with information 
derived from foreign intelligence that contributes to 
efforts directed at countering terrorism, weapons 
proliferation, drug smuggling, illegal migration, 
and transnational crime. More recently, CSE has 
begun to provide these same clients with technical 
assistance. 


CSE is working closely with the Canadian Forces 
Information Operations Group (CFIOG) to enhance 
support to Canadian military operations, with direct 
service now provided by CFIOG. (CFIOG was 
created in April 1998 from a consolidation of various 
National Defence elements, including the Canadian 
Forces Supplementary Radio Systems. It provides a 
focal point for Information Operations). 


Through its ITS program, CSE continues to 


encourage and support Canadian firms in the 
development of new security products. 
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Additionally, CSE has an ongoing relationship with 
several government departments and agencies and 
assists them in assessing their ITS needs as they 
migrate toward on-line service delivery. 


CSE provided senior level expertise to the 
government’s Critical Infrastructure Protection Task 
Force. Created in April 2000, the Task Force 
recommended what the federal government should 
do to protect that part of Canada’s infrastructure 
that is critical to the health, safety, security, and 
economic well-being of Canadians. 


EVO LUTION CSE must contend with the revolutionary pace of 
technological change. The foundation of its 


OF CSE activities is technology, which affects CSE, like its 
partners, in several ways: 


The pressures for 


change ¢ The channels through which foreign 


communications travel are multiplying. The new 
wireless, fibre optic and Internet communications 
technologies continue to advance, requiring CSE’s 
computer scientists and engineers to expand and 
upgrade their knowledge base constantly. 


e The targets of foreign intelligence collection 
activities, including terrorist groups, now have 
easy access to the sophisticated products of a 
multi-trillion dollar telecommunications industry, 
including digital encryption technology, available 
as freeware on the World Wide Web, making it 
difficult if not impossible to decipher their 
communications. 


e Increasingly, vast amounts of information are 
moving through new channels of communication, 
making it highly labour-intensive for CSE to 
identify useful information. 


¢ Canadian government departments and agencies 
are also using new modes of communication that 
interconnect with computer systems that contain 
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sensitive information or control critical 
infrastructure. They look to CSE’s ITS experts 
for advice to protect their communications 
networks and computer systems. 


° The number of attacks on government networks 
and systems is growing. A September 2000 study 
on threats to federal Internet sites estimated that a 
typical site is subject to 10 or more threat 
incidents each week. Moreover, the frequency of 
foreign attacks on US systems that originate or 
pass through Canada is becoming an issue. 


¢ The government’s new Office of Critical 
Infrastructure Protection and Emergency 
Preparedness, announced in February 2001 and 
charged with developing and implementing a 
comprehensive approach to protecting Canada’s 
critical infrastructure, will look to CSE for 
technical support. 


CSE’s strategic During the year under review, CSE embarked upon 
plan an important strategic exercise to identify 
alternative approaches to delivering its mandate. 


As a Starting point, CSE defined its vision: “to be 
the agency that masters the global information 
network to enhance Canada’s safety and 
prosperity”. In so doing, CSE has effectively 
returned to its roots with the recognition that its 
core strength is its ability to understand and protect 
communications and communications systems. 
CSE’s ability to exploit these systems to provide 
foreign intelligence flows from this core strength. 


In support of its vision, CSE aims to become a 
centre of excellence that develops and applies its 
technical expertise and understanding of global 
communications networks and helps Canada meet 
its critical information needs. 
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CSE has adopted three strategic goals for the next 
10 years: 


+ to be the acknowledged governmental centre of 
excellence in understanding and addressing the 
capacities of the global network 


¢ to protect and enable the Canadian information 
infrastructure 


e to modernize CSE services, products and 
delivery. 


As a first step, CSE has strengthened the linkage 
between its SIGINT and ITS programs. Although 
their activities are related, they have traditionally 
operated at arm’s length from each other. To achieve 
its strategic goals, CSE intends to benefit from the 
synergies created by drawing the two programs 
closer. By exploring the vulnerabilities of 
communications and information systems together, 
SIGINT and ITS experts now pool their knowledge 
to identify threats to Canadian systems as well as 
opportunities for foreign intelligence collection. 


In June 2000, the Chief of CSE briefed me on this 
topic. Subsequently, my office has discussed the 
strategy in detail with CSE’s senior management. 
I do not believe this approach will change how I 
review CSE’s activities in any fundamental way, 
since my focus will remain on their lawfulness. 

In the meantime, I have expressed my support of 
this undertaking. 


REVI EWI NG My mandate to review the activities of CSE and to 
report to the Minister of National Defence is 
CSE contained in an Order in Council (see Annex A). 


The Commissioner’s Each year, my office identifies areas within CSE’s 
role operations where, at first view, questions of 
lawfulness might be presumed. Under my authority, 
my office then conducts systematic reviews of these 
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operations. I pass the results of these reviews to the 
Minister of National Defence in the form of 
classified reports. The fact that I have issued a 
classified report is not an indication that I have 
uncovered an incident of unlawfulness. Rather, it is 
an indication that the report contains sensitive 
information that requires classified handling. 


The effort that goes into researching and preparing 
my reports to the Minister accounts for the bulk of 
the work of my office and gives me a detailed 
understanding of various aspects of CSE’s 
operations. 


I have reviewed CSE’s authorities to collect foreign 
intelligence on behalf of the Government of 
Canada and its mandate to protect the security of 
the government’s information technology. On an 
ongoing basis, I examine CSE’s policies, directives 
and actual practices to ensure they contribute to 
lawfulness and to protecting Canadians’ privacy. 


Among other issues, my reviews have looked at 
how CSE provides intelligence reports to its 
clients, and the receipt of intelligence from its 
Second Party partners. I regularly monitor CSE’s 
operational activities, as well as circumstances that 
have led to internal security investigations. 


Annex B contains a list of the classified reports I 
have passed to the Minister since my appointment 
in 1996. 


2000-2001 During the past year, I continued to review CSE’s 
activities activities as they relate to the intelligence cycle and 
the handling and production of intelligence 
product. As I outlined in my last annual report, 
CSE conducts daily reviews of the raw traffic it 
receives from multiple sources and assesses its 
foreign intelligence value against the government’s 


Foreign 
intelligence product 
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priorities. CSE then passes the results to its 
government clients in the form of intelligence 
product. 


This past year, I reviewed the policies and handling 
practices associated with CSE’s receipt and 
retention of foreign intelligence traffic. I examined 
how CSE identifies issues of intelligence interest 
within the raw traffic it receives and the practices 
associated with its retention and subsequent 
dissemination in the form of intelligence reporting. 
And, as is my practice, I reviewed CSE’s policies 
and practices, within this cycle of activities, that 
deal specifically with safeguarding the privacy of 
Canadians. 


Information I also reviewed CSE’s information management 
management policies in light of the National Archives of Canada 
Act and Treasury Board policy and guidelines 
related to the management of information holdings. 


Government departments and agencies are required 
to establish Records Disposition Authorities for 
their operational and administrative holdings. 
These Authorities grant permission to departments 
and agencies to dispose of certain holdings and 
require them to forward to the National Archives 
other holdings identified to be of archival interest, 
for preservation. 


I observed that these Authorities do not constitute a 
requirement to destroy records, nor do they provide 
direction regarding the timing of records 
destruction. Moreover, they do not provide or 
authorize records retention periods. Retention and 
disposal periods are determined by the designated 
Minister of the institution and must, of course, 
conform to any other applicable legislation. 
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Policy authority 


Other activities 


I was satisfied that CSE’s policies conform with 
existing law and policy requirements related to the 
management of government information holdings. 
I recommended, however, that CSE give priority to 
completing its retention and disposal schedules. 


In my 1998-99 Annual Report, I indicated my 
intention to examine the new framework for policy 
authority, accountability and coordination that CSE 
had recently adopted. Of particular interest to me 
were two of the objectives of the framework: 

to identify the appropriate level of authority for 
various policies; and to provide a desirable level 

of operational flexibility in support of day-to-day 
activities. 


During the past year, I reviewed the new framework 
and found it to be well conceived and sound. It will 
take time, however, to convert all CSE policy to the 
framework. While some policy gaps remain, CSE 
has policies for its major requirements, and the new 
system should address my earlier concerns about 
having policy in the right place and signed off at the 
right level. 


During the year under review, I was pleased to learn 
that officials had opened discussions on having 
cornerstone internal policies issued to CSE as 
Ministerial direction. I applaud this initiative, 
because it will strengthen the accountability linkages 
between CSE and the Minister of National Defence, 
who is responsible for CSE in Parliament. 


My mandate authorizes me to investigate 
complaints by Canadians or permanent residents of 
Canada about CSE activities. While there were 
informal inquiries during 2000-2001, none led to a 
formal complaint. 
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During the past year, my office has maintained its 
informal contacts within the security and intelligence 
community. We were particularly pleased to receive 
the Inspector General of South Africa during his 
autumn 2000 tour of North America. I look forward 
to renewing acquaintances with my counterparts 
from other countries at the upcoming conference of 
review agencies in Washington in October 2001. 


2000-2001 findings I am satisfied that during the period under review, 
CSE acted lawfully in the performance of its 
mandated activities and did not target the 
communications of Canadian citizens or permanent 
residents. I make this statement on the basis of the 
thorough review of CSE’s activities conducted 
during the year. 


My mandate requires me to inform the Minister of 
National Defence and the Attorney General of 
Canada of any CSE activity that I believe may not be 
in compliance with the law. To date, I have not been 
required to do so. CSE 1s aware of its boundaries, 
receives legal advice from counsel appointed to CSE 
by the Department of Justice, and has policies and 
procedures in place to promote lawfulness. 

These measures have proven to be effective. 


Office staff and During the 2000-2001 fiscal year, my budget 
budget allocation was $648,800. I can report that actual 
expenses incurred were well within budget. 


My office continues to consist of two full-time 
employees and a number of subject-matter experts 
whom I employ on contract. At present, there are 
five people performing specialized work under this 
arrangement, all of whom have the required 
security clearances. This provides me with both 
continuity and flexibility to obtain the expertise I 
require to review CSE’s activities effectively. 
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LOOKING 
AHEAD 


Safeguarding the 
privacy of 
Canadians 


As I have previously observed, CSE’s foreign 
intelligence collection technology must constantly 
progress to keep pace with advances in 
communications technology. Despite the 
efficiencies inherent in new technologies, CSE is 
still likely to receive inadvertently some small 
amount of Canadian communications. Moreover, 
each new collection system or technique that 
comes on stream seems to bring with it this 
potential. However, CSE is well aware that it must 
continually upgrade its capabilities to screen out 
Canadian communications or risk acting 
unlawfully if it does not make every effort to do so. 


In this regard, I have informed CSE that, in 
addition to my other review activities, I will be 
seeking assurance that it is availing itself of all 
emerging technologies to ensure that the privacy of 
Canadians is safeguarded. 
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P.C. 1999-10488 
June 8, 1999 


CANADA 


PRIVY COUNCIL e CONSEIL PRIVÉ 


His Excellency the Governor General in 


Council, on the recommendation of the Minister of 
National Defence, pursuant to Part II of the Inquiries 


hereby authorizes the Minister of National Defence 


(in this order referred to as "the Minister") 


(a) to re-appoint the Honourable 

Claude Bisson of Montreal, Quebec, for a period of 
three years, as a commissioner ("the 
Commissioner") to review the activities of the 
Communications Security Establishment (“CSE”) for 
the purpose of determining whether those 
activities are in compliance with the law; 


(b) to authorize the Commissioner to commence that 
review on his own initiative or at the request of 
the Minister; 


(c) to authorize the Commissioner to investigate 
any complaint, concerning the lawfulness of CSE 
activities, made by any individual who is a 
Canadian citizen or a permanent resident of 
Canada; 


(d) to authorize the Commissioner not to 
investigate complaints for which, in the 
Commissioner’s opinion, other avenues of redress 
are established by statute; 


(e) to specifically authorize the Commissioner to 
inform any complainant of the results of his 
investigation, ensuring that no classified 
information is disclosed to the complainant; 


(f) to direct the Commissioner to inform the 
Minister and the Attorney General of Canada of any 


CSE activity that the Commissioner believes may 
not be in compliance with the law; 


se 
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(gd) Oo direct the Commissioner to submit. to the 
Minister, once each year and in both official 
languages, a report on the Commissioner’s 
activities and findings that are not classified, 
which report the Minister will table in 
Parliament; 


(h) to authorize the Commissioner, at any time the 
Commissioner considers it advisable, to submit a 
report containing classified information to the 
Minister; 


(1) to direct the Commissioner, before submitting 
any report to the Minister, to consult with the 
Deputy Secretary to the Cabinet (Security and 
Intelligence) at the Privy Council Office for the 
purpose of ensuring compliance with all security 
requirements and the preservation of the secrecy 
of sources of security and intelligence 
information and of the security of information 
provided to Canada in confidence by other nations; 


(j) to direct the Commissioner and all persons 
engaged on his behalf take an oath of secrecy and 
comply with all applicable government security 
requirements; 


(k) to authorize the Commissioner to engage the 
services of any staff, advisors and counsel that 
he considers necessary to assist him in the 
performance of his duties and functions at such 
rates of remuneration and reimbursement as may be 
approved by the Treasury Board; 
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(1) to fix the remuneration of the Commissioner at 
the per diem rate set out in the annexed schedule, 
which rate is within the range of $400 to $500; 
and 


(m) to authorize that the Commissioner be paid 
reasonable travel and living expenses incurred by 
him in the performance of his duties and functions 
while absent from his ordinary place of residence, 
in accordance with Treasury Board travel 
directives; 


effective June 19, 1999. 


CERTIFIED TO BE A TRUE COPY-COPIE CERTIFIEE CONFORME 


CLERK OF THE PRIVY COUNCIL-LE GREFFIER DU CONSEIL PRIVE 
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Classified Reports, 1996-2001 
Classified Report to the Minister - March 3, 1997 (TOP SECRET) 


Classified Report to the Minister 
- Operational Policies with Lawfulness Implications - February 6, 1998 - 
(SECRET) 


Classified Report to the Minister 
- CSE’s Activities under *** - March 5, 1998 (TOP SECRET Codeword/CEO) 


Classified Report to the Minister 
- Internal Investigations and Complaints - March 10, 1998 (SECRET) 


Classified Report to the Minister 
- CSE'Ss activities under *** - December 10, 1998 (TOP SECRET/CEO) 


Classified Report to the Minister 
- On controlling communications security (COMSEC) material - May 6, 1999 
(TOP SECRET) 


Classified Report to the Minister 
- How We Test (A classified report on the testing of CSE’s signals intelligence 
collection and holding practices, and an assessment of the organization’s 
efforts to safeguard the privacy of Canadians) - June 14, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
- A Study of the *** Collection Program - November 19, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
- On *** - December 8, 1999 (TOP SECRET - COMINT) 


Classified Report to the Minister 


- Study of the *** Reporting Process - an overview (Phase I) - December 8, 
1999 (SECRET/CEO) 
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Classified Report to the Minister 
- A Study of Selection and *** - an overview - May 10, 2000 (TOP 
SECRET/CEO) 


Classified Report to the Minister 
- CSE’s Operational Support Activities Under *** - follow-up - May 10, 2000 
(TOP SECRET/CEO) 


Classified Report to the Minister 
- Internal Investigations and Complaints - follow-up - May 10, 2000 (SECRET) 


Classified Report to the Minister 
- On findings of an external review of CSE’s ITS Program - June 15, 2000 
(SECRET) 


Classified Report to the Minister 
- CSE’s Policy System Review - September 14, 2000 (TOP SECRET/CEO) 


Classified Report to the Minister 
- A study of the *** Reporting Process - Phase II *** - April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 


- A study of the *** Reporting Process - Phase III *** - April 6, 2001 
(SEGRET/CEO) 
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INTRODUCTION 


Since my last annual report was released in 

May 2001, the context in which Canada’s security 
and intelligence community works has been 
transformed. Members of the Canadian Forces 
have gone into action in Afghanistan. Our closest 
neighbour is still recovering from the terrorist 
attacks of September 11. Police and intelligence 
officials are working across Canada and with their 
counterparts elsewhere to prevent further terrorist 
activity in this country and abroad. 


This new environment has given Canadians a 
growing awareness of the contributions to our 
well-being that are made by the members of our 
security and intelligence community, as well as 
police, fire services, enforcement officials, and 
military forces. Canadians rely on them to detect 
threats to public safety and to stop those who want 
to harm us or our allies. 


The agency I review — the Communications Security 
Establishment (CSE) — joined other security and 
intelligence organizations in responding to the 
events of the past nine months. CSE provides the 
government with foreign intelligence by collecting, 
analyzing and reporting on information such as 
electronic emissions and data it acquires from 

the global information infrastructure (signals 
intelligence). It also helps ensure that the Canadian 
government’s electronic information and its 
infrastructure are secure from interception, 
disruption, manipulation or sabotage (information 
technology security). 


In the immediate aftermath of September 11, CSE 
employees worked around the clock to contribute to 
the worldwide effort to identify those responsible 
for the attacks in the United States and to prevent 
additional attacks. Together with other members of 
Canada’s security and intelligence community, 
CSE formed new partnerships in common cause 
against the threat of terrorism. 
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The Government of Canada quickly reaffirmed 
terrorism as a matter of national concern affecting 
the security of the nation. Noting that “the challenge 
of eradicating terrorism, with its sophisticated and 
trans-border nature, requires enhanced international 
cooperation and a strengthening of Canada’s 
capacity to suppress, investigate and incapacitate 
terrorist activity’! the government introduced into 
Parliament last October its omnibus Bill C-36, 

the Anti-terrorism Act.? 


To strengthen Canada’s ability to combat terrorism, 
and to respond to threats to Canadian lives and 
interests from terrorism, the Bill proposed several 
amendments to existing Acts. Of particular interest 
to me were the proposed amendments to the Official 
Secrets Act and the National Defence Act, the latter 
providing the legislative basis for both the activities 
of CSE and the role of the CSE Commissioner. 

Bill C-36, which was passed by Parliament and 
proclaimed on December 24, 2001, also introduced 
new elements to the roles of CSE and my Office. 


In this year’s annual report, I describe those parts of 
the legislation that affect CSE and the Commissioner 
and the implications of the legislation. As required 
by my mandate I also report on the 2001-2002 
activities and findings of my Office. 


The Anti-terrorism Act is a major piece of 
legislation with numerous elements affecting many 
areas of government activity. Despite concerns 
expressed about the haste with which the legislation 
was drafted and debated, I know with certainty that 
those parts of the legislation that deal with CSE and 


! From the preamble to Bill C-36, the Anti-terrorism Act, S.C. 2001, c. 41. 


2 The Anti-terrorism Act: An Act to amend the Criminal Code, the Official 
Secrets Act, the Canada Evidence Act, the Proceeds of Crime (Money 
Laundering) Act and other Acts, and to enact measures respecting the 
registration of charities, in order to combat terrorism. 


the CSE Commissioner benefited from years of 
discussion within government long before 
September 11. 


More than a As long ago as 1990, the House of Commons 
decade of debate Special Committee on the Review of the Canadian 
| Security Intelligence Service Act and the Security 

Offences Act recommended that Parliament 
establish CSE by statute. Although the government 
chose not to act on the recommendation at that 
time, it did indicate that it was “considering 
providing the Minister of National Defence with 
some additional capacity for review of CSE.” This 
ultimately led to my appointment in 1996 as the 
first Commissioner of CSE. 


The issue of legislation for CSE arose again in 
1996 when the Privacy Commissioner completed 
his examination of CSE. He concluded that, to the 
extent it could be established through his audit, 
CSE operated in compliance with the Privacy Act 
and the principles of fair information practices. 
However, he too recommended the enactment of 
enabling legislation for CSE. 


Later that year, the Auditor General of Canada 
tabled a report on the Canadian intelligence 
community in which he called on the government 
to consider the advantages of an appropriate 
legislative framework for CSE. He reiterated this 
view in a short 1998 follow-up report. 


Similarly, in 1999, the Senate Committee on 
Security and Intelligence, chaired by former 
Senator William Kelly, recommended that CSE 
have its own Act of Parliament and that the 
legislation provide for a permanent and separate 
review body for CSE. 


In four of my annual reports, I raised the matter of 
legislation for CSE. I expressed the view, in these 
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reports and elsewhere, that legislation would be an 
appropriate development that would put CSE on a 
firm footing by articulating its mandate and powers 
and its relationships with Parliament, the 
government, and the Minister of National Defence. 


Suddenly and unexpectedly, what had been 
discussed for many years became a reality. The 
government accepted the advice of its independent 
observers and agreed that, in the context of the 
omnibus Bill C-36, the time was right to introduce 
legislation for CSE and the CSE Commissioner. 


In my view, the passage of legislation dealing 

with CSE and the Commissioner is a welcome 
development. Moreover, I believe the legislation 
appropriately takes into account the critical 

balance between the needs of the state to collect 
information to protect its citizens and the individual 
rights of those citizens to privacy. 


The parts of the Act that relate to CSE and the 
Commissioner are described below. 


Communications The Anti-terrorism Act provides a legislative base 
Security for CSE by amending the National Defence Act. 
Establishment The new section 273.64 of the National Defence 


Act states: 
mandate eis: 


(1) The mandate of the Communications 
Security Establishment is 


(a) to acquire and use information from the 
global information infrastructure for the 
purpose of providing foreign intelligence, 
in accordance with Government of Canada 
intelligence priorities; 


(b) to provide advice, guidance and services 
to help ensure the protection of electronic 
information and of information infrastructures 
of importance to the Government of Canada; 
and 
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(c) to provide technical and operational 
assistance to federal law enforcement and 
security agencies in the performance of their 
lawful duties. 


(2) Activities carried out under paragraphs (1)(a) 
and (b) 


(a) shall not be directed at Canadians or any 
person in Canada; and 


(b) shall be subject to measures to protect the 
privacy of Canadians in the use and retention 
of intercepted information. 


These provisions have the effect of enshrining in 
legislation the historical activities of CSE. 


Ministerial The National Defence Act also allows the Minister 
authorization of National Defence to authorize CSE to intercept 
private communications in specific circumstances, 
by issuing a written Ministerial authorization. The 
Minister may, for the sole purpose of obtaining 
foreign intelligence, issue an authorization if 
satisfied that: 


(a) the interception will be directed at foreign 
entities located outside Canada; 


(b) the information to be obtained could not 
reasonably be obtained by other means; 


(c) the expected foreign intelligence value of the 
information that would be derived from the 
interception justifies it; and 


(d) satisfactory measures are in place to protect 
the privacy of Canadians and to ensure that 
private communications will only be used or 
retained if they are essential to international 
affairs, defence or security. 
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In the past, CSE was prohibited from intercepting 
any communication in which one of the participants 
in the communication was in Canada — even if the 
target of the interception was outside Canada. 

This new provision allows the Minister of 

National Defence to authorize such interceptions 

in circumstances defined in the authorization. 

An example might be a communication in which 

a person of foreign intelligence interest in another 
country contacts a counterpart in Canada. 


The new legislation also allows the Minister 

to issue authorizations to intercept private 
communications “for the sole purpose of protecting 
the computer systems or networks of the 
Government of Canada from mischief, 
unauthorized use or interference.” Section 273.65 
(4) of the National Defence Act sets out the 
conditions for such an authorization: 


(a) the interception is necessary to identify, isolate 
or prevent harm to Government of Canada 
computer systems or networks; 


(b) the information to be obtained could not 
reasonably be obtained by other means; 


(c) the consent of persons whose private 
communications may be intercepted cannot 
reasonably be obtained; 


(d) satisfactory measures are in place to ensure 
that only information that is essential to 
identify, isolate or prevent harm to 
Government of Canada computer systems or 
networks will be used or retained; and 


(e) satisfactory measures are in place to protect 
the privacy of Canadians in the use or 
retention of that information. 


The legislation directs the CSE Commissioner to 
review the activities carried out under Ministerial 
authorizations to ensure they are authorized and to 
report annually to the Minister on the review. 
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The In addition to assigning responsibility for 
AA. ; reviewing CSE’s activities under Ministerial 
oa, > authorizations, the National Defence Act now sets 
manaate out the duties of the Commissioner’s office as 
follows: 


(a) to review the activities of the [CSE] to ensure 
that they are in compliance with the law; 


(b) in response to a complaint, to undertake any 
investigation that the Commissioner considers 
necessary; and 


(c) to inform the Minister [of National Defence] 
and the Attorney General of Canada of any 
activity of the [CSE] that the Commissioner 
believes may not be in compliance with the 
law. 


In effect, the mandate I have been fulfilling since 
1996 by Order in Council is now entrenched in law. 


Public interest The Anti-terrorism Act also made significant 

changes in the former Official Secrets Act, now 
gelence called the Security of Information Act. The Act now 

prohibits people bound by secrecy from 
communicating or confirming “special operational 
information”, which 1s defined to include 
information about the kinds of activities CSE 
lawfully undertakes. 


A person would not be found guilty of an offence 
under this part of the Act, however, if that person 
could establish that he or she acted in the public 
interest by communicating or confirming special 
operational information. The Act states that a 
person acts in the public interest if the person’s 
purpose is to disclose “an offence under an Act of 
Parliament that he or she reasonably believes has 
been, is being or is about to be committed by 
another person in the purported performance of that 
person’s duties and functions for, or on behalf of, 
the Government of Canada.” The public interest in 
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disclosure must outweigh the public interest in non- 
disclosure. This is why it is called a public interest 
defence. 


A judge or court can consider a public interest 
defence only if the person involved, before 
disclosing special operational information, brought 
his or her concerns to the attention of the 
institution’s deputy head or the Deputy Attorney 
General of Canada. If a person with a concern 
about CSE’s activities does not receive a response 
from the deputy head or Deputy Attorney General 
within a reasonable time, he or she must then bring 
the concern to the CSE Commissioner and must 
allow a reasonable time for the Commissioner to 
respond. Failure to do so precludes that person 
from using the public interest defence. 


Implications It will take some time to fully assess the 

for the implications of the Anti-terrorism Act for my work. 

Commissioner The responsibility of reviewing CSE activities under 
Ministerial authorizations is a significant one. 

These authorizations will extend CSE’s activities 
into new areas, and I will want to ensure that CSE 
has appropriate policies and procedures in place, 
and that it applies them, to protect the privacy of 
Canadians as it implements this expanded mandate. 


The Commissioner’s role in public interest defence 
cases is comparable in some ways to my continuing 
responsibility to consider complaints about CSE, 
and I anticipate that the measures I have in place to 
address complaints will allow me to respond 
quickly and appropriately to any concerns raised 
about CSE’s activities under the Security of 
Information Act. Very few complaints about CSE 
have been brought to me since I took office in 1996. 
It remains to be seen whether the new public 
interest defence provisions will generate additional 
activity. 
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With the Commissioner’s mandate now clearly 
established in law, I will no longer need to debate the 
theoretical merits of one arrangement for reviewing 
CSE over another. However, the Commissioner’s 
new status as an ongoing institution of government 
raises a host of practical administrative issues that 
must now be addressed. For one thing, I will need to 
ensure my Office is sufficiently resourced to review 
CSE’s expanded activities. Other issues, such as the 
Office’s place in government, must also be explored 
in coming months. 


2001-2002 As Parliamentarians considered the Anti-terrorism 

Act last autumn, they sought my views on the parts 
ACTIVITES “of ihe ievistation dealing with CSHand the GSE 
Anti-terrorism Commissioner. I appeared in October 2001 before 

legislation the Special Senate Committee on the Subject Matter 

of Bill C-36, and in November I submitted a brief to 
the House of Commons Standing Committee on 
Justice and Human Rights. The texts of my opening 
remarks to the Senate Committee and my brief to 
the House of Commons Committee are available on 
my Office’s website at http://csec-ccst.gc.ca. 


Since the passage of the legislation, my staff and 
I have focused on my new responsibilities. 

Most significantly, I began preparations early in 
2002 to launch my first review of CSE’s activities 
under Ministerial authorization issued by the 
Minister of National Defence. I will be reporting 
the results to the Minister later this year. 


Between the passage of the legislation and the end 
of the 2001-2002 fiscal year, I received no requests 
to consider concerns about the activities of CSE 
from persons seeking to establish a public interest 
defence under the Security of Information Act as 

it relates to the disclosure of special operational 
information. 
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My mandate authorizes me to submit classified 
reports to the Minister about CSE’s activities. Since 
my appointment in 1996, I have submitted 19 such 
reports, including two in 2001-2002, and two others 
were nearing completion at year’s end. The 
inquiries I made to produce these reports revealed 
no evidence of unlawful activity by CSE. A 
complete list of the classified reports I have 
submitted to the Minister can be found in Annex B. 


During 2001-2002, I received one complaint from a 
member of the public concerning CSE. I reviewed 
this complaint and determined that no further action 
was required. 


Each year in this report I state my findings about 
the lawfulness of CSE’s activities based upon the 
results of a series of reviews. These reviews 
include, but are not limited to, an examination of 
the legal authorities under which CSE conducts its 
activities as well as related policies and practices. 


I am able to report that I am satisfied that those 
CSE activities examined during the period under 
review complied with law and existing policy. 
Further, I found no evidence that CSE targeted the 
communications of Canadian citizens or permanent 
residents. 


In April 2002 the government introduced Bill C-55, 
the Public Safety Act. Still under consideration by 
Parliament as I write this, the Bill is a companion 
piece to the Anti-terrorism Act passed in December 
2001. Bill C-55 proposes legislative changes on a 
wide range of subjects, from transportation safety 
and immigration to biological weapons. 
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Of particular interest to me is a proposed amendment 
to the National Defence Act that would confer a new 
responsibility on the Commissioner of CSE for 
reviewing activities undertaken by the Department of 
National Defence or the Canadian Forces to protect 
their computer networks and systems. 


Over the coming months, I will review this new 
legislative provision and the impact it may have on 
my office. 


Budget and staff During the 2001-2002 fiscal year, my budget 
allocation was $647,150. I can report that actual 
expenses incurred were well within budget. 


My office consists of full-time staff, several 
subject-matter experts whom I engage on a part- 
time basis, and an independent legal counsel. I 
benefit from this arrangement, which allows me to 
bring on board people whose backgrounds are 
well-suited to conducting specialized work in an 
evolving and technically challenging field. 


Resource requirements for the coming year are 
under review, given additional responsibilities 
conferred on the Commissioner through 
amendments to the National Defence Act and the 
Security of Information Act. 


Commissioner’s Although the position of Commissioner of the 
reappointment Communications Security Establishment is now 

established in law, the appointment of the 
individual to fill the office is still made by the 
Governor in Council for a specified term. My 
current appointment is for a three-year term that 
expires in June 2002, and I have been reappointed 
for a further year to June 2003. 
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Review agencies The third international Review Agencies 

Conference was scheduled to take place in 
cone ee Washington, D.C., in mid-October 2001, following 

on conferences in Canberra (1997) and Ottawa 
(1999). Following the events of September 11, the 
Washington conference was cancelled. My 
colleagues and I convened in London, England, 
May 12-14, 2002, to exchange knowledge and 
experiences and to renew acquaintanceships. 


LOOKING Last year, I concluded my report by observing that 
CSE must constantly progress to keep pace with 


AHEAD technological advances. Only by doing this can 
Safeguarding the CSE improve its ability to screen out Canadian 
: communications and safeguard the privacy of 
privacy of 


é Canadians. 
Canadians 


Despite the enormity of events since my last report 
and the pressures now on Canada’s security and 
intelligence community to provide information and 
produce results, to my mind the issue of privacy 
remains paramount. 


CSE’s additional powers under Ministerial 
authorization are new and important tools in the fight 
against terrorism. At the same time, however, they 
must be used judiciously and in a manner consistent 
with the letter and the spirit of the law. This will 
require conscientious effort on the part of all parties 
as we establish and implement appropriate 
procedures to discharge our legislated duties. 


I am also well aware of the challenges these new 
powers present for the review of CSE’s activities. 
I intend to fulfil my responsibilities in the year 
ahead vigilantly, with this fact firmly in mind. 
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F.C. 1999-10428 
June 8, 1999 


CANADA 


PRIVY COUNCIL e CONSEIL PRIVÉ 


His Excellency the Governor General in 
Council, on the recommendation of the Minister of 
National, Defence, pursuant to Part II.of the.Inquiries 
Act, hereby authorizes the Minister of National Defence 
(in this order referred to as "the Minister") 


(a) to re-appoint the Honourable 

Claude Bisson of Montreal, Quebec, for a period of 
three years, aS a commissioner ("the 
Commissioner") to review the activities of the 
Communications Security Establishment (“CSE”) for 
the purpose of determining whether those 
activities are in compliance with the law; 


(b) to authorize the Commissioner to commence that 
review on his own initiative or at the request of 
the Minister; fi 


(c) to authorize the Commissioner to investigate 
any complaint, concerning the lawfulness of CSE 
activities, made by any individual who is a 
Canadian citizen or a permanent resident of 
Canada; : | 


(d) to authorize the Commissioner not to 
investigate complaints for which, in the 
Commissioner’s opinion, other avenues of redress 
are established by statute; 


(e) to specifically authorize the Commissioner to 
informyany,compLainant.of.theuresults.of bis 
investigation, ensuring that no classified 
information is disclosed to the complainant; 


(f) to direct the Commissioner to inform the 
Minister and the Attorney General of Canada of any 


CSE activity that the Commissioner believes may 
not be in compliance with the law; 


ie 
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(g) to direct the Commissioner to submit to the 
Minister, once each year and in both official 
languages, a report on the Commissioner’s 
activities and findings that are not classified, 
which report the Minister will table in 
Parliament; 


(h) to authorize the Commissioner, at any time the 
Commissioner considers it advisable, to submit a 
report containing classified information to the 
Minister; 


(1) to direct the Commissioner, before submitting 
any report to the Minister, to consult with the 
Deputy Secretary to the Cabinet (Security and 
Intelligence) at the Privy Council Office for the 
purpose of ensuring compliance with all security 
requirements and the preservation of the secrecy 
of sources of security and intelligence 
information and of the security of information 
provided to Canada in confidence by other nations; 


(j) to direct the Commissioner and all persons 
engaged on his behalf take an oath of secrecy and 
comply with all applicable government security 
requirements; 


(k) to authorize the Commissioner to engage the 
services of any staff, advisors and counsel that 
he considers necessary to assist him in the 
performance of his duties and functions at such 
rates of remuneration and reimbursement as may be 
approved by the Treasury Board; 


a Ae 
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(1) to fix the remuneration of the Commissioner at 
the per diem rate set out in the annexed schedule, 
which rate is within the range of $400 to $500; 
and 


(m) to authorize that the Commissioner be paid 
reasonable travel and living expenses incurred by 
him in the performance of his duties and functions 
while absent from his ordinary place of residence, 
in accordance with Treasury Board travel 
directives; 


effective June 19, 1999. 


CERTIFIED TO BE A TRUE COPY-COPIE CERTIFIÉE CONFORME 


CLERK OF THE PRIVY COUNCIL-LE GREFFIER DU CONSEIL PRIVE 
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Classified Reports, 1996-2002 
Classified Report to the Minister - March 3, 1997 (TOP SECRET) 


Classified Report to the Minister 
- Operational Policies with Lawfulness Implications - February 6, 1998 
(SECRET) 


Classified Report to the Minister 
- CSE’s Activities under *** - March 5, 1998 (TOP SECRET Codeword/CEO) 


Classified Report to the Minister 
- Internal Investigations and Complaints - March 10, 1998 (SECRET) 


Classified Report to the Minister 
- CSE’s activities under *** - December 10, 1998 (TOP SECRET/CEO) 


Classified Report to the Minister 
- On controlling communications security (COMSEC) material - May 6, 1999 
(TOP SECRET) 


Classified Report to the Minister 
- How We Test (A classified report on the testing of CSE’s signals intelligence 
collection and holding practices, and an assessment of the organization’s 
efforts to safeguard the privacy of Canadians) - June 14, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
- A Study of the *** Collection Program - November 19, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
- On *** - December 8, 1999 (TOP SECRET - COMINT) 


Classified Report to the Minister 
- A Study of the *** Reporting Process - an overview (Phase I) - December 8, 
1999 (SECRET/CEO) 


Classified Report to the Minister 


- A Study of Selection and *** - an overview - May 10, 2000 (TOP 
SECRET/CEO) 
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Classified Report to the Minister 
- CSE’s Operational Support Activities Under *** - follow-up - May 10, 2000 
(TOP SECRET/CEO) 


Classified Report to the Minister 
- Internal Investigations and Complaints - follow-up - May 10, 2000 (SECRET) 


Classified Report to the Minister 
- On findings of an external review of CSE’s ITS Program - June 15, 2000 
(SECRET) 


Classified Report to the Minister 
- CSE’s Policy System Review - September 14, 2000 (TOP SECRET/CEO) 


Classified Report to the Minister 
- A study of the *** Reporting Process - Phase IT *** - April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
- A study of the *** Reporting Process - Phase III *** - April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
- CSE’s participation *** - August 20, 2001 (TOP SECRET/CEO) 


Classified Report to the Minister 


- CSE’s support to ***, as authorized by *** and *** - August 20, 2001 (TOP 
SECRET/CEO) 
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INTRODUCTION 


This is my seventh and final report as 
Commissioner of the Communications Security 
Establishment (CSE), as my appointment will 
terminate in June 2003. It is also the first time since 
my initial appointment in 1996 that my review of 
CSE’s activities and my annual report have been 
guided by legislation. 


In my last report I pointed out that after more than a 
decade of debate about the pros and cons of 
enabling legislation for CSE, the tragic events of 

11 September 2001 precipitated the introduction 
and passage of the omnibus Anti-Terrorism Act by 
Parliament. The resulting amendments to the 
National Defence Act, which came into effect on 

24 December 2001, created a legislated mandate for 
CSE as well as for the CSE Commissioner. The new 
provisions of the National Defence Act enshrined in 
legislation the historical activities of CSE as well as 
the activities I had been carrying out since 1996, but 
they also introduced new elements. These are 
described more fully in the next section. 


Much of this past year has been taken up with 
assessing the implications of my new duties and 
making a start on meeting the requirements of the 
legislation. As a result, it has been a year of much 
challenge and change for both CSE and my Office 
as we move toward a common understanding of our 
respective roles and responsibilities. 


In this year’s annual report I look back briefly on 
seven years of evolution and development in the 
Commissioner’s role. I also report on the review 
activities and findings of my Office in 2002-03. 
These addressed CSE’s two main programs (Signals 
Intelligence and Information Technology Security) 
as well as some of its other activities. Finally, I look 
forward to developments that are already on the 
horizon and to the appointment of my successor. 
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THE EVOLVING 
ROLE OF THE 
COMMISSIONER 


Since I started as Commissioner in 1996, the highly 
complex environment in which CSE works has 
changed dramatically. So has the work of my Office 
and the expectations placed upon it. 


One aspect of the change results from the 
technology-rich environment within which CSE 
works — and the technology involved has been 
advancing at an accelerating pace throughout this 
time. Another key element relates to changes in the 
intelligence environment that derive from evolving 
political, social and economic realities. These have 
led to new threats to Canada’s security, defence and 
national interests and changes to the government’s 
intelligence priorities. To address these challenges, 
CSE has expanded its role in the collection, 
analysis and reporting of information and 
intelligence. My staff and I have had to learn about 
the complex technologies involved and to stay on 
top of the rapid changes taking place in order to 
carry out the Commissioner’s review role 
effectively and efficiently. 


Throughout this period of dynamic change in 
technology, in the intelligence environment, and in 
CSE’s activities, I have been guided by the 
principle that Canadians deserve the assurance that 
CSE, which must of necessity conduct most of its 
business in secret, does so in compliance with the 
laws of Canada. Providing this assurance has been 
my responsibility, and I have sought to fulfil it by 
maintaining the breadth, depth and credibility of 
my Office’s review work, with a particular focus on 
those matters that could put the privacy of 
Canadians at risk. 


The Commissioner’s role, as it had developed under 
mandates set out in the June 1996 and June 1999 
Orders in Council appointing me Commissioner, 
was confirmed and extended by Parliament in the 
Anti-Terrorism Act of December 2001. The most 
significant extension of my role arises from 
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provisions that allow the Minister of National 
Defence to authorize CSE’s interception of the 
private communications of Canadians in specific 
circumstances and subject to several conditions set 
out in the legislation.! Section 183 of the Criminal 
Code defines private communications as 


..any oral communication, or any 
telecommunication, that is made by an 
originator who is in Canada or is intended 

by the originator to be received by a person 
who is in Canada, and that is made under 
circumstances in which it is reasonable for 

the originator to expect that it will not be 
intercepted by any person other than the 
person intended by the originator to receive it... 


This new power of CSE to intercept private 
communications when authorized by the Minister is 
a significant development, bringing with it obvious 
risks to the privacy of Canadians. These risks are 
recognized in the legislation, which requires, among 
other things, that the Minister be satisfied that CSE 
has satisfactory measures in place to protect the 
privacy of Canadians. In addition, the legislation 
directs the Commissioner to review activities 
carried out under each ministerial authorization to 
ensure that they are indeed authorized, and to report 
annually to the Minister on the review. Based on 
experience to date, I anticipate that this will be a 
substantial and challenging aspect of the 
Commissioner’s role in the future. 


A further extension to the Commissioner’s role was 
set out in the Security of Information Act (the 
former Official Secrets Act). This Act prohibits 
people bound by secrecy from communicating or 
confirming “special operational information”, 
including special operational information about 


! Before December 2001, CSE would have been in violation of privacy- 
related provisions of both the Criminal Code and the Canadian Charter of 
Rights and Freedoms had it intercepted communications without the 
certainty that, in doing so, it would not intercept private communications. 
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CSE’s activities. A person would not be found 
guilty of an offence, however, if that person could 
establish that he or she acted in the public interest. 
A judge can consider a “public interest defence” 
only if the person involved has taken a series of 
steps set out in the legislation before disclosing the 
information. These steps may include bringing 
concerns about CSE’s activities to the 
Commissioner and allowing a reasonable time for 
the Commissioner to respond. Although I am 
hopeful that this role will rarely be exercised, it is 
potentially an important one and is likely to be 
demanding when a concern is brought to the 
Commissioner’s attention. 


The legislative provisions setting out the mandate 
of the Commissioner of the Communications 
Security Establishment are included in Annex A. 


2002-03 Under the Orders in Council that set out my 
mandate from 19 June 1996 until 24 December 
ACTIVITI ES 2001, my Office carried out a planned series of 
Classified Reports reviews of CSE’s activities each year. These 
reviews were directed at areas where, in my 
opinion, the very nature of CSE’s activities gave 
rise to risks relating to lawfulness. Because I was 
authorized to submit reports containing classified 
material to the Minister of National Defence at any 
time I considered advisable, I made it a practice to 
report the results of each of my reviews to the 
Minister in the form of a classified report. 


The new legislation has introduced some important 
changes to my mandate. As described above, the 
Minister of National Defence may now authorize 
CSE to intercept the private communications of 
Canadians in some circumstances. Although I am 
still required to review CSE’s activities generally to 
ensure that they are in compliance with the law, the 
legislation also directs me specifically to review 
CSE activities carried out under a ministerial 
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authorization to ensure they are authorized, and to 
report annually to the Minister on the review. 


In other words, I no longer have a completely free 
hand in choosing subjects for review. Nor does my 
new legislated mandate specifically authorize me to 
submit reports containing classified material to the 
Minister whenever I consider it advisable. 
Nevertheless, in cases where I do choose the 
subjects for review, I believe it is sensible to 
continue the reporting practices established under 
my earlier mandate, as they have served well in the 
past. 


During 2002-03 I forwarded four classified reports 
to the Minister, and another was nearing completion 
at the end of the year. These included reports 
mandated under the new legislation as well as 
reports on reviews of my own choosing. Annex C 
provides a list of all my classified reports to the 
Minister since my appointment in 1996. 


As I have pointed out in the past, submitting a 
classified report to the Minister does not mean that 
I have identified any lack of compliance with the 
law or ministerial authority. It indicates only that 
the report contains material that requires classified 
handling. Indeed, I am pleased to say that none of 
the reviews on which my 23 classified reports are 
based (including the four reviews completed in 
2002-03) identified incidents of unlawfulness or 
unauthorized activity. 


Reviews of Under sub-sections 273.65 (1) and (3) of the 
Activities under National Defence Act, the Minister of National 
Ministerial Defence has authorized CSE, in writing, to 

UMR intercept private communications for the purposes 

Authorizations of obtaining foreign intelligence and protecting the 
computer systems or networks of the government 
from mischief, unauthorized use or interference. 
Because many of the activities carried out under 
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these authorizations were new to CSE, they gave 
rise to significant challenges relating not only to 
technology, but also to such matters as determining 
appropriate roles and responsibilities, developing 
policy and procedures to guide activities, and 
designing controls to ensure compliance with the 
conditions imposed by the legislation and the 
ministerial authorizations. CSE continues to 
address these challenges. 


Information obtained from CSE indicates that the 
bulk of the communications intercepted under these 
authorizations are not in fact private 
communications (that is, they are not the 
communications of Canadians). Nevertheless, I 
believe that the unique focus of my review must be 
on private communications. Whatever else CSE 
may intercept, it is the interception of private 
communications that is specifically authorized by 
the Minister. Moreover, it is with respect to the 
interception, use and retention of private 
communications that issues of lawfulness and 
compliance with ministerial authority are most 
likely to arise. As a result, my Office devoted a 
significant part of its efforts during the past year to 
learning how CSE is acquiring, identifying, 
accessing, retaining and using such 
communications, as well as what kind of policy 
regime, procedures and management control 
framework it is putting in place. In doing so, my 
staff and I examined a variety of documents and 
correspondence, had several discussions with CSE 
officials, and attended briefings and information 
sessions. In addition, I asked CSE to take me 
through a specific tasking under one of the 
authorizations. 


My Office completed a preliminary review of 
activities under one ministerial authorization. This 
authorized CSE to conduct activities from Canada 
relating to the interception of communications for 
the sole purpose of obtaining foreign intelligence 
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and, in doing so, to intercept private 
communications subject to conditions defined in 
the legislation and in the ministerial authorization. 
As required by the legislation, I reported the 
findings of this preliminary review to the Minister. 
Because of the focus of the ministerial 
authorization, and because the review was a first for 
my Office, my preliminary report related more to 
process and to the class of activities authorized than 
to CSE’s compliance with authority. I anticipate 
that in future annual reports to the Minister under 
paragraph 273.65 of Part V.1 of the National 
Defence Act, the Commissioner will be in a position 
to address compliance issues more directly. 


My reviews of activities under other ministerial 
authorizations in effect during 2002-03 were 
continuing at the end of the year and will be the 
subject of reports to the Minister in the near future. 


Other Reviews CSE’s operational support to the Canadian 
Security Intelligence Service. The Canadian 
Security Intelligence Service (CSIS) is authorized 
to assist the ministers of National Defence and 
Foreign Affairs in collecting foreign intelligence 
within Canada. In carrying out its duties and 
functions, CSIS may, in turn, seek operational 
assistance and support from other departments and 
agencies, including CSE. 


In 2002-03 my staff completed an examination of 
CSE’s policies and practices in the context of a 
specific case where it provided operational support 
to CSIS. This examination found no evidence of 
unlawful activity on the part of CSE or any of its 
employees. Indeed, all the activities examined 
complied with CSE policies as well as relevant 
legal authorities. 


My report did, however, make a number of 
recommendations designed to address weaknesses 
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in policy and practice that could lead to errors in 
handling sensitive information and to an inconsistent 
application of policy and law. CSE has started to take 
action to address the concerns | raised. 


Information Technology Security. In earlier annual 
reports I discussed changes in the focus and 
complexity of activities undertaken by CSE under 
its Information Technology Security (ITS) program 
to protect government communications and 
communications systems. Among other things, the 
ITS program has shifted strategically toward a more 
open mode of doing business in the face of growing 
vulnerabilities as more and more government 
organizations adopt evolving technologies such as 
the Internet and electronic commerce. 


To respond to a significantly expanded client base 
and greater demand for its services, the ITS 
program has actively sought cooperative 
partnerships and alliances with government and 
private sector organizations. These arrangements 
are usually formalized in written agreements 
between the parties. My Office reviewed formal 
agreements between the ITS program and external 
parties, as well as the policies, practices and 
procedures governing them, to identify issues and 
assess implications relating to lawfulness. 


The review showed no evidence of unlawful 
activity on the part of CSE with respect to its 
arrangements with government and private sector 
organizations and the agreements arising from such 
arrangements. However, my report pointed to 
shortcomings in the administration of agreements 
as well as gaps in policy that created unnecessary 
risks in this regard. I have been informed that CSE 
is taking action to review and address my concerns 
and recommendations. 


CSE’s policies and procedures. One of my long- 


standing observations, based on several reviews 
carried out during my term as Commissioner, is that 
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CSE’s internal policies and procedures have not 
always provided clear and consistent definitions 
and uses of key terms. I have found that policies 
and associated documentation were confusing at 
times, especially in instances where certain terms 
have multiple definitions. 


As a follow-up to these observations, my staff 
compiled a lexicon of definitions of key terms from 
a number of different instruments, and I made that 
report available to the Minister and to CSE. In the 
course of this work, I learned that CSE is giving a 
high priority to the development and articulation of 
policies and procedures to guide operations under 
its mandate in the National Defence Act. This effort 
includes establishing new policies and procedures 
where necessary, as well as reviewing existing 
policies and procedures to ensure they are current 
and that they use accurate and consistent 
terminology. 


I am encouraged by these developments at a time 
of expanded security and intelligence activity 
when, among other things, there are clear needs for 
CSE to retrain existing staff and to train and guide 
an anticipated influx of new employees. In these 
circumstances it is vitally important to ensure clear 
and consistent understanding and application of 
policy and procedures — including terminology 
used — throughout the organization. My Office will 
continue to monitor CSE’s progress in this regard 
closely. 


2002-03 Findings Each year in this report I provide an overall 
statement on my findings about the lawfulness of 


CSE’s activities based on the results of reviews my 
staff carried out during the year. Because of my 
new mandate under the National Defence Act, 

this is the first time my statement extends beyond 
lawfulness to compliance with ministerial 
authority. 
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Complaints and 
Concerns about 
CSE Activities 


Review Agencies 
Conference 
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I am able to report that the activities of CSE that 
my Office reviewed during the year complied with 
law and ministerial authority. In particular, while I 
found no evidence that CSE directed its activities at 
Canadians or any person in Canada, I did see 
evidence that CSE has measures to protect the 
privacy of Canadians in the use and retention of 
intercepted information. 


Paragraph 273.63 (2)(b) of the National Defence 
Act requires me, in response to a complaint, to 
undertake any investigation I consider necessary. 
During 2002-03, I received no complaints about 
CSE activities from any source. 


Neither were concerns about CSE activities 
addressed to me under the public interest defence 
provisions of the Security of Information Act. 


The third International Intelligence Review 
Agencies Conference was held in London, England, 
from 12-15 May 2002. Representatives of review 
agencies from Australia, Belgium, Canada, New 
Zealand, Poland, Slovakia, South Africa, and the 
United States met their United Kingdom 
counterparts to exchange views on issues of 
common interest in the historical setting of 
Lancaster House. 


In addition to discussing review arrangements in 
our respective jurisdictions, we examined the issue 
of review from the perspectives of the agency being 
reviewed and the public, as well as in relation to 
changes in technology. I remain grateful to our 
hosts for their outstanding hospitality. 
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THE 
COMMISSIONER’S 


OFFICE 
Office Expenditures 


and Staff 


Accommodation 


LOOKING 


AHEAD 
The Public Safety 
Act 


My budget allocation for the 2002-03 fiscal year 
was $921,950. Because the December 2001 
amendments to the National Defence Act expanded 
my duties significantly, this allocation was 42 per 
cent greater than my budget in the previous year. 
The actual expenditures incurred in 2002-03 (see 
Annex B) were well within the budget. 


During the year, my Office continued to consist of 
a small full-time staff. In addition, to help carry out 
my duties, I engaged the services of an independent. 
legal counsel and several subject-matter experts on 
an ongoing basis. 


My Office has occupied the same premises since 
my appointment in 1996, although by 1998 it was 
becoming evident that these premises offered 
insufficient accommodation for the staff and 
advisors I required to discharge my responsibilities. 
This situation became more acute following the 
additional responsibilities assigned to me by 
Parliament in late 2001. 


In late 2002, I was advised that a larger office 
space was about to become available in the 
building that my Office has occupied since 1996. It 
was evident that this space would suit current 
requirements and also provide some flexibility for 
the future. My Office moved to its new location in 
May 2003. 


In October 2002 the government introduced 

Bill C-17, the Public Safety Act, in Parliament. 
This bill, which replaced the earlier Bill C-55 
(which in turn had replaced Bill C-42), was still 
under consideration as I was writing this report. 
Bill C-17 proposes legislative changes on a wide 
range of subjects, from transportation safety and 
immigration to biological weapons. Among the 
proposed changes are amendments to the National 
Defence Act that would confer significant new 
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Commissioner 
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responsibilities on the Commissioner of CSE for 
reviewing the lawfulness and compliance with 
ministerial authority of activities undertaken by the 
Department of National Defence or the Canadian 
Forces to protect their computer systems and 
networks, and for dealing with complaints arising 
from such activities. 


I have informed the government of my concerns 
regarding the role proposed for the Commissioner in 
this Bill and its predecessors. Those concerns centre 
around the difficulties I can foresee in providing 
meaningful assurance of lawfulness and compliance 
with ministerial authority. In addition, however, 

I believe that assuming these new and potentially 
complex responsibilities would raise the question of 
whether the Commissioner’s role could be carried 
out effectively on a part-time basis in the future. 


In the meantime I have asked my officials to 
undertake a preliminary assessment of the review 
mandate envisaged in Bill C-17 so as to identify 
more clearly the systems that would be involved 
and the size of the sample of activities that would 
need to be reviewed for the Commissioner to give 
the assurances required. This will provide my 
successor with better information on the nature 
and extent of the work involved, and the possible 
impacts on this Office’s resource requirements, 
should Parliament choose to confer these new 
duties on the Commissioner. 


My appointment as Commissioner expires on 
19 June 2003. 


Paragraph 273.63 (1) of the National Defence Act 
provides that the Governor in Council may appoint 
either a supernumerary judge or a retired judge 

of a superior court as Commissioner of the 
Communications Security Establishment. However, 
I am concerned that a supernumerary judge would 
face serious limitations in carrying out the full 
range of duties and responsibilities involved. 


These limitations arise from the blurring of lines 
between the executive and legislative arms of 
government on the one hand, and the judiciary on 
the other, that would result from appointing a 
supernumerary judge. For example, a supernumerary 
judge would not be in a position to comment on 
proposed legislation — as I have had occasion to do 
from time to time. Similarly, a supernumerary 

judge ought not to appear as a witness before 
parliamentary committees. Although I am somewhat 
disappointed not to have been called as a witness 
before parliamentary committees to discuss my 
annual reports, as a retired judge I would at least 
have been able to do so. 


Regardless of the Governor in Council’s decision, 
I wish my successor well in this fascinating and 
challenging assignment. 


Concluding Finally, I would like to take this opportunity to say 
Thoughts that serving Canada and Canadians during the past 

seven years has been a source of great and enduring 
satisfaction for me. I am convinced that through the 
very existence of this external review function, 
through the assurances that I have been able to 
provide and the opportunities for improvement that 
reviews have identified, my Office has made an 
important contribution to strengthening the control 
and accountability of CSE. 


I would also like to say goodbye and to thank those 
I have worked with for seven years. In particular, 
the skill, dedication and unfailing good cheer of my 
staff have helped me immeasurably and have 
guided me through some challenging times. But I 
am also grateful for the respect and courtesy that 
CSE and other government officials have 
consistently extended to me and my staff. Their 
cooperation has made our task much easier. 
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Mandate of the Commissioner 
of the Communications Security Establishment 


National Defence Act - Part V1 


“273.63 (1) The Governor in Council may appoint a supernumerary judge or a 
retired judge of a superior court as Commissioner of the Communications 
Security Establishment to hold office, during good behaviour, for a term of not 
more than five years. 


(2) The duties of the Commissioner are 


(a) to review the activities of the Establishment to ensure that they are in 
compliance with the law; 


(b) in response to a complaint, to undertake any investigation that the 
Commissioner considers necessary; and 


(c) to inform the Minister and the Attorney General of Canada of any activity 
of the Establishment that the Commissioner believes may not be in compliance 
with the law. 


(3) The Commissioner shall, within 90 days after the end of each fiscal year, 
submit an annual report to the Minister on the Commissioner’s activities and 
findings, and the Minister shall cause a copy of the report to be laid before each 
House of Parliament on any of the first 15 days on which that House is sitting 
after the Minister receives the report. : 


(4) In carrying out his or her duties, the Commissioner has all the powers of a 
commissioner under Part II of the /nguiries Act. 


(5) The Commissioner may engage the services of such legal counsel, technical 
advisers and assistants as the Commissioner considers necessary for the proper 
performance of his or her duties and, with the approval of the Treasury Board, 
may fix and pay their remuneration and expenses. 


(6) The Commissioner shall carry out such duties and functions as are assigned 
to the Commissioner by this Part or any other Act of Parliament, and may carry 
out or engage in such other related assignments or activities as may be authorized 
by the Governor in Council. 


(7) The Commissioner of the Communications Security Establishment holding 
office immediately before the coming into force of this section shall continue in 
office for the remainder of the term for which he or she was appointed. 


ANNEX A 15 


“273.65 (8) The Commissioner of the Communications Security Establishment 
shall review activities carried out under an authorization issued under this section 
to ensure that they are authorized and report annually to the Minister on the 
review.’ 


Security of Information Act 


“15. (1) No person is guilty of an offence under section 13 or 14 if the 
person establishes that he or she acted in the public interest. 


“15. (5) A judge or court may decide whether the public interest in the 
disclosure outweighs the public interest in non-disclosure only if the person has 
complied with the following: 


“15. (5) (b) the person has, if he or she has not received a response from the 
deputy head or the Deputy Attorney General of Canada, as the case may be, 
within a reasonable time, brought his or her concern to, and provided all relevant 
information in the person’s possession to, 


(1) the Communications Security Establishment Commissioner, if the person’s 
concern relates to an alleged offence that has been, is being or is about to be 
committed by a member of the Communications Security Establishment, in 
the purported performance of that person’s duties and functions of service for, 
or on behalf of, the Communications Security Establishment, and he or she 
has not received a response from the Communications Security Establishment 
Commissioner within a reasonable time.” 
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Budget and Expenditures 2002-03 


Expenditures 


Salaries and Wages 201,935 
Transportation and Telecommunications 21,808 
Information Lows 
Professional and Special Services 209,699 
Rentals 157,708 
Purchased Repair and Maintenance PEM ao) 
Materials and Supplies 4,438 
Acquisition of Machinery and Equipment 26,098 
Other Expenditures 22 
Total $856,823 
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Classified Reports, 1996-2003 
Classified Report to the Minister — March 3, 1997 (TOP SECRET) 


Classified Report to the Minister 


- Operational Policies with Lawfulness Implications - February 6, 1998 
(SECRET) 


Classified Report to the Minister 
- CSE’s Activities under *** - March 5, 1998 (TOP SECRET Codeword/CEO) 


Classified Report to the Minister 
- Internal Investigations and Complaints - March 10, 1998 (SECRET) 


Classified Report to the Minister 
- CSE’s activities under *** - December 10, 1998 (TOP SECRET/CEO) 


Classified Report to the Minister 
- On controlling communications security (COMSEC) material - May 6, 1999 
(TOP SECRET) 


Classified Report to the Minister 
- How We Test (A classified report on the testing of CSE’s signals intelligence 
collection and holding practices, and an assessment of the organization’s 
efforts to safeguard the privacy of Canadians) - June 14, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
- A Study of the *** Collection Program - November 19, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
- On *** - December 8, 1999 (TOP SECRET - COMINT) 


Classified Report to the Minister 
- A Study of the *** Reporting Process - an overview (Phase I) - December 8, 
1999 (SECRET/CEO) 


Classified Report to the Minister 


- A Study of Selection and *** - an overview - May 10, 2000 (TOP 
SECRET/CEO) 


ANNEX C 19 


Classified Report to the Minister 
- CSE’s Operational Support Activities Under *** - follow-up - May 10, 2000 
(TOP SECRET/CEO) 


Classified Report to the Minister 
- Internal Investigations and Complaints - follow-up - May 10, 2000 (SECRET) 


Classified Report to the Minister 
- On findings of an external review of CSE’s ITS Program - June 15, 2000 
(SECRET) 


Classified Report to the Minister 
- CSE’s Policy System Review - September 14, 2000 (TOP SECRET/CEO) 


Classified Report to the Minister 
- A study of the *** Reporting Process - Phase IT *** - April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
- A study of the *** Reporting Process - Phase HII *** - April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
- CSE’s participation *** - August 20, 2001 (TOP SECRET/CEO) 


Classified Report to the Minister 
- CSE’s support to ***, as authorized by *** and *** - August 20, 2001 (TOP 
SECRET/CEO) 


Classified Report to the Minister 
- A study of the formal agreements in place between CSE and various external 
parties in respect of CSE’s Information Technology Security (ITS) - August 21, 
2002 (SECRET) 


Classified Report to the Minister 
- CSE’s support to CSIS, as authorized by *** and code named *** - November 
13, 2002 (TOP SECRET/CEO) 


Classified Report to the Minister 
- CSE’s SIGINT activities carried out under the *** 2002 *** ministerial 
authorization November 27, 2002 (TOP SECRET/CEO) 


Classified Report to the Minister 
- LEXICON - 26 March 2003 (TOP SECRET/COMINT) 
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